5aa82085d0e21dfe6198f58076142c8e80e253b8575ab2723918bb4a9915cd79

Analysis

max time kernel
138s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03/06/2022, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Telux.com_Swift_03_06_2022.xls
Size 70KB
Sample220603-sdwa2aada4
SHA256 5aa82085d0e21dfe6198f58076142c8e80e253b8575ab2723918bb4a9915cd79
MD5 5c493563c7c87cb96eee7077a179b2cf
SHA1 f48e583f542d64e0930bd6011d7a7ca63bd2434a
SHA512 13a1fa396fa7d0410cad8232cce24a703ccce89d34f5f83dc55670fcee3612126cb9924b78a169153b819e47165a54635fc8c11b02dea1cd3bed17822714eb2b
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://www.boucherie-thollas.com/wp-content/Q/
xlm40.dropper
http://www.wenne24.keurigonline52.nl/cgi-bin/FsHQ3ndkZb/
xlm40.dropper
http://www.supersanmutfak.com/Template/fMh7nu/

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2544	532	regsvr32.exe	79
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2084	532	regsvr32.exe	79
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2960	532	regsvr32.exe	79

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2084	regsvr32.exe
2960	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
532	EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE
532	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2544	532	EXCEL.EXE	90
PID 532 wrote to memory of 2544	532	EXCEL.EXE	90
PID 532 wrote to memory of 2084	532	EXCEL.EXE	92
PID 532 wrote to memory of 2084	532	EXCEL.EXE	92
PID 532 wrote to memory of 2960	532	EXCEL.EXE	95
PID 532 wrote to memory of 2960	532	EXCEL.EXE	95

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Telux.com_Swift_03_06_2022.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\cusoa1.ocx
  2⤵
  - Process spawned unexpected child process
  PID:2544
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\cusoa2.ocx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  PID:2084
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\cusoa3.ocx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  PID:2960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cusoa2.ocx

Path C:\Users\Admin\cusoa2.ocx
Size 578KB
SHA256 2a7b1f9eda1767fb8d5b8195b6078d967377627b2c250052d3513a126e1e395f
MD5 05263327ebdf09cb56ba66db58aeb259
SHA1 ba6eb6db28e8b89d77e4633e24790f4472eb15f1
SHA512 bb9b036f0d2dcbe6aee6e301acd57025abc00d9c32650d58efbb8337e0d30925841e989026d019b279c9f30bcd5ab74e1a0a2069243a66299a4c2eb7bbef75b3
SSDEEP 12288:gwtccwVfQec59aEilIc5rmNLm2O1uDnFyXRm6ZM7XNBZxXjiSnD5ANR+a7:HtccwM59aErmFEFyhmFTNBZxziS+NR1
MD5 SHA1 SHA512 SSDEEP

Submit Download

cusoa2.ocx

Path C:\Users\Admin\cusoa2.ocx
Size 578KB
SHA256 2a7b1f9eda1767fb8d5b8195b6078d967377627b2c250052d3513a126e1e395f
MD5 05263327ebdf09cb56ba66db58aeb259
SHA1 ba6eb6db28e8b89d77e4633e24790f4472eb15f1
SHA512 bb9b036f0d2dcbe6aee6e301acd57025abc00d9c32650d58efbb8337e0d30925841e989026d019b279c9f30bcd5ab74e1a0a2069243a66299a4c2eb7bbef75b3
SSDEEP 12288:gwtccwVfQec59aEilIc5rmNLm2O1uDnFyXRm6ZM7XNBZxXjiSnD5ANR+a7:HtccwM59aErmFEFyhmFTNBZxziS+NR1
MD5 SHA1 SHA512 SSDEEP

Submit Download

cusoa3.ocx

Path C:\Users\Admin\cusoa3.ocx
Size 578KB
SHA256 e5d16990ff9a5873c9baace3769eb922300cd2cebe8eaab371cb099813db5850
MD5 1daf88e5aeea0c732e3138e98d09435a
SHA1 c9626cf4c4dc8c9661c1b8d60c026eab83481be6
SHA512 ee3d5bb7130de19c15b45f827879af4ef16ca6b65d56e0d870827ee014aa6319775c1e3252804656f93801a91d1d64a81c3338a355b0f2a275f7aea2f5525831
SSDEEP 12288:gwtccwVfQec59aEilIc5rmNLm2O1uDnFyXRm6ZM7XNBexXjiSnD5ANR+a7:HtccwM59aErmFEFyhmFTNBexziS+NR1
MD5 SHA1 SHA512 SSDEEP

Submit Download

cusoa3.ocx

Path C:\Users\Admin\cusoa3.ocx
Size 578KB
SHA256 e5d16990ff9a5873c9baace3769eb922300cd2cebe8eaab371cb099813db5850
MD5 1daf88e5aeea0c732e3138e98d09435a
SHA1 c9626cf4c4dc8c9661c1b8d60c026eab83481be6
SHA512 ee3d5bb7130de19c15b45f827879af4ef16ca6b65d56e0d870827ee014aa6319775c1e3252804656f93801a91d1d64a81c3338a355b0f2a275f7aea2f5525831
SSDEEP 12288:gwtccwVfQec59aEilIc5rmNLm2O1uDnFyXRm6ZM7XNBexXjiSnD5ANR+a7:HtccwM59aErmFEFyhmFTNBexziS+NR1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-133-0x00007FFABBC10000-0x00007FFABBC20000-memory.dmp

Download

memory/532-135-0x00007FFAB92B0000-0x00007FFAB92C0000-memory.dmp

Download

memory/532-136-0x00007FFAB92B0000-0x00007FFAB92C0000-memory.dmp

Download

memory/532-134-0x00007FFABBC10000-0x00007FFABBC20000-memory.dmp

Download

memory/532-130-0x00007FFABBC10000-0x00007FFABBC20000-memory.dmp

Download

memory/532-131-0x00007FFABBC10000-0x00007FFABBC20000-memory.dmp

Download

memory/532-132-0x00007FFABBC10000-0x00007FFABBC20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads