8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578.xlsm
8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578.xlsm
48KB
14-03-2022 20:19
1655267f2eef17c7bea81ee6cf65fbf9
dd062a715bd8eee2b8b4d30e6786e5b108b63c1a
8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578
Extracted
Language | xlm4.0 |
Source |
|
URLs |
xlm40.dropper
http://www.arkpp.com/ARIS-BSU/9K1/ |
Filter: none
-
Process spawned unexpected child processregsvr32.exe
Description
This typically indicates the parent process was compromised via an exploit or macro.
Reported IOCs
description pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3136 2472 regsvr32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Checks processor information in registryEXCEL.EXE
Description
Processor information is often read in order to detect sandboxing environments.
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registryEXCEL.EXE
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListenerEXCEL.EXE
Reported IOCs
pid process 2472 EXCEL.EXE -
Suspicious use of SetWindowsHookExEXCEL.EXE
Reported IOCs
pid process 2472 EXCEL.EXE 2472 EXCEL.EXE 2472 EXCEL.EXE 2472 EXCEL.EXE 2472 EXCEL.EXE 2472 EXCEL.EXE 2472 EXCEL.EXE 2472 EXCEL.EXE 2472 EXCEL.EXE -
Suspicious use of WriteProcessMemoryEXCEL.EXE
Reported IOCs
description pid process target process PID 2472 wrote to memory of 3136 2472 EXCEL.EXE regsvr32.exe PID 2472 wrote to memory of 3136 2472 EXCEL.EXE regsvr32.exe PID 2472 wrote to memory of 3136 2472 EXCEL.EXE regsvr32.exe
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578.xlsm"Checks processor information in registryEnumerates system info in registrySuspicious behavior: AddClipboardFormatListenerSuspicious use of SetWindowsHookExSuspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\fbd.dllProcess spawned unexpected child process
-
memory/2472-118-0x00007FFB7EB50000-0x00007FFB7EB60000-memory.dmp
-
memory/2472-119-0x00007FFB7EB50000-0x00007FFB7EB60000-memory.dmp
-
memory/2472-120-0x00007FFB7EB50000-0x00007FFB7EB60000-memory.dmp
-
memory/2472-121-0x00007FFB7EB50000-0x00007FFB7EB60000-memory.dmp
-
memory/2472-122-0x00007FFBBEAC0000-0x00007FFBBEC9B000-memory.dmp
-
memory/2472-123-0x00007FFBBCA90000-0x00007FFBBCB3E000-memory.dmp