8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578.xlsm

General
Target

8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578.xlsm

Filesize

48KB

Completed

14-03-2022 20:19

Score
10/10
MD5

1655267f2eef17c7bea81ee6cf65fbf9

SHA1

dd062a715bd8eee2b8b4d30e6786e5b108b63c1a

SHA256

8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578

Malware Config

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://www.arkpp.com/ARIS-BSU/9K1/
Signatures 7

Filter: none

Discovery
  • Process spawned unexpected child process
    regsvr32.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process31362472regsvr32.exeEXCEL.EXE
  • Downloads MZ/PE file
  • Checks processor information in registry
    EXCEL.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringEXCEL.EXE
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0EXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzEXCEL.EXE
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUEXCEL.EXE
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    2472EXCEL.EXE
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXE

    Reported IOCs

    pidprocess
    2472EXCEL.EXE
    2472EXCEL.EXE
    2472EXCEL.EXE
    2472EXCEL.EXE
    2472EXCEL.EXE
    2472EXCEL.EXE
    2472EXCEL.EXE
    2472EXCEL.EXE
    2472EXCEL.EXE
  • Suspicious use of WriteProcessMemory
    EXCEL.EXE

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2472 wrote to memory of 31362472EXCEL.EXEregsvr32.exe
    PID 2472 wrote to memory of 31362472EXCEL.EXEregsvr32.exe
    PID 2472 wrote to memory of 31362472EXCEL.EXEregsvr32.exe
Processes 2
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578.xlsm"
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe -s ..\fbd.dll
      Process spawned unexpected child process
      PID:3136
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads

                        • memory/2472-118-0x00007FFB7EB50000-0x00007FFB7EB60000-memory.dmp

                          Download

                        • memory/2472-119-0x00007FFB7EB50000-0x00007FFB7EB60000-memory.dmp

                          Download

                        • memory/2472-120-0x00007FFB7EB50000-0x00007FFB7EB60000-memory.dmp

                          Download

                        • memory/2472-121-0x00007FFB7EB50000-0x00007FFB7EB60000-memory.dmp

                          Download

                        • memory/2472-122-0x00007FFBBEAC0000-0x00007FFBBEC9B000-memory.dmp

                          Download

                        • memory/2472-123-0x00007FFBBCA90000-0x00007FFBBCB3E000-memory.dmp

                          Download