Analysis
-
max time kernel
190s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:37
Behavioral task
behavioral1
Sample
988760f89f3d5dff972bd106281d414b109f97bbf86cbaf82854f62a01e6a116.xls
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
988760f89f3d5dff972bd106281d414b109f97bbf86cbaf82854f62a01e6a116.xls
Resource
win10v2004-20220414-en
General
-
Target
988760f89f3d5dff972bd106281d414b109f97bbf86cbaf82854f62a01e6a116.xls
-
Size
252KB
-
MD5
f30e1af67d6b2fed16936271b412605e
-
SHA1
832b81bf4283198c002dee45117fe75ff47cacc4
-
SHA256
988760f89f3d5dff972bd106281d414b109f97bbf86cbaf82854f62a01e6a116
-
SHA512
ab60822978edf79519dd5faad372f893a0ce8575370c7e92f48b70bdf4ad5843a2364cb06388157556ca215b5bad2a66d137e12a606d1bcd91d35792935f1a61
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exeexplorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2832 4084 explorer.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4940 4084 explorer.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 38 4500 WScript.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
Processes:
explorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4084 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE 4084 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEexplorer.exeexplorer.exedescription pid process target process PID 4084 wrote to memory of 2832 4084 EXCEL.EXE explorer.exe PID 4084 wrote to memory of 2832 4084 EXCEL.EXE explorer.exe PID 5000 wrote to memory of 4856 5000 explorer.exe WScript.exe PID 5000 wrote to memory of 4856 5000 explorer.exe WScript.exe PID 4084 wrote to memory of 4940 4084 EXCEL.EXE explorer.exe PID 4084 wrote to memory of 4940 4084 EXCEL.EXE explorer.exe PID 2288 wrote to memory of 4500 2288 explorer.exe WScript.exe PID 2288 wrote to memory of 4500 2288 explorer.exe WScript.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\988760f89f3d5dff972bd106281d414b109f97bbf86cbaf82854f62a01e6a116.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\jaT6RtDI.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\Q8SOT.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaT6RtDI.vbs"2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Q8SOT.vbs"2⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DBp1.txtFilesize
3B
MD521438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
C:\Users\Admin\AppData\Local\Temp\Q8SOT.vbsFilesize
773B
MD50fdb00bb29b69e0cf9f139a649178cee
SHA189ee3ac481833df2e1174854082ccbb00019f9f2
SHA256e0b993c05ea7a55c687bc5a873c6f64336473d766366f2a31104156e6105de66
SHA5127faffb3e048d2615ee6a516ff656fa23d75b7a4cf0f36af35d7734fb18530ddc96f17c34baa860101b0b962d7ab6af8b8c8a4b7defc73354e99b1943db1cc119
-
C:\Users\Admin\AppData\Local\Temp\jaT6RtDI.vbsFilesize
337B
MD54a46e5cbc144f612e1d0223594864fc1
SHA1e8a0a5770f8b0d5d6f5ce8e4f5102089bc46bba6
SHA2569f72eb7049708ff7cf50ccf16dd87a4b1cd8771e93a06d89cca4e53288478bde
SHA51233020a9b29653998248fe7c1be2ab357e1f441cb36a1829cae42537088a2a0999ad4c49b18afa5e32615c8fc18084a07c3fe276652d4da2c4ec04121a50109e1
-
memory/2832-137-0x0000000000000000-mapping.dmp
-
memory/4084-136-0x00007FFB80C60000-0x00007FFB80C70000-memory.dmpFilesize
64KB
-
memory/4084-135-0x00007FFB80C60000-0x00007FFB80C70000-memory.dmpFilesize
64KB
-
memory/4084-130-0x00007FFB82E50000-0x00007FFB82E60000-memory.dmpFilesize
64KB
-
memory/4084-134-0x00007FFB82E50000-0x00007FFB82E60000-memory.dmpFilesize
64KB
-
memory/4084-133-0x00007FFB82E50000-0x00007FFB82E60000-memory.dmpFilesize
64KB
-
memory/4084-131-0x00007FFB82E50000-0x00007FFB82E60000-memory.dmpFilesize
64KB
-
memory/4084-132-0x00007FFB82E50000-0x00007FFB82E60000-memory.dmpFilesize
64KB
-
memory/4500-143-0x0000000000000000-mapping.dmp
-
memory/4856-139-0x0000000000000000-mapping.dmp
-
memory/4940-141-0x0000000000000000-mapping.dmp