General
Target

88ee09c8848b1775e3e470d64fbe64f877e9edfc172a21318acbe0f2f99ac9df.xls

Filesize

40KB

Completed

21-05-2022 13:02

Task

behavioral1

Score
10/10
MD5

35cef72c5abdb47cc705de2459f6bf16

SHA1

2639ec69b35fa5633b0555bc61e4feda7ae23994

SHA256

88ee09c8848b1775e3e470d64fbe64f877e9edfc172a21318acbe0f2f99ac9df

SHA256

27c0c534eb18e19a6598b737787a4ce1fa70732d5ca6720070232fc4567b606bce4c2069cd2f15ac341e28af7095b13eb930d099b796d33be4a2b2ccab3ce043

Malware Config

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://jimlowry.com/9tag/Mv2ZYY61NBOf8/

xlm40.dropper

http://stainedglassexpress.com/classes/veV/

xlm40.dropper

https://n-process.jp/base/HPH/

xlm40.dropper

http://www.4-hzim.org.zw/language/anCpC49vTB4/

xlm40.dropper

http://salledemode.com/tgroup.ge/6USqthYYyIPw4V/

xlm40.dropper

http://poiterdesign.eu/huur/nc/

Signatures 4

Filter: none

Discovery
  • Checks processor information in registry
    EXCEL.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0EXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringEXCEL.EXE
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUEXCEL.EXE
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    4624EXCEL.EXE
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXE

    Reported IOCs

    pidprocess
    4624EXCEL.EXE
    4624EXCEL.EXE
    4624EXCEL.EXE
    4624EXCEL.EXE
    4624EXCEL.EXE
    4624EXCEL.EXE
    4624EXCEL.EXE
    4624EXCEL.EXE
Processes 1
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\88ee09c8848b1775e3e470d64fbe64f877e9edfc172a21318acbe0f2f99ac9df.xls"
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    PID:4624
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/4624-114-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp

                        • memory/4624-115-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp

                        • memory/4624-116-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp

                        • memory/4624-117-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp

                        • memory/4624-126-0x00007FFCDAC90000-0x00007FFCDACA0000-memory.dmp

                        • memory/4624-127-0x00007FFCDAC90000-0x00007FFCDACA0000-memory.dmp

                        • memory/4624-276-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp

                        • memory/4624-277-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp

                        • memory/4624-278-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp

                        • memory/4624-279-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp