Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 04:38
Behavioral task
behavioral1
Sample
details_1250658.zip
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
details_1250658.zip
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
details_1250658.xls
Resource
win7-20220414-en
General
-
Target
details_1250658.xls
-
Size
95KB
-
MD5
5e15d87d47605b7bb5a71b4e846fe555
-
SHA1
1b7e83cc5c58db319e574405166f07f39b57eb82
-
SHA256
400a576272826f7ad7f20a0689f56617b5354d5f2b84629bc1034177f1c4d060
-
SHA512
ac8a0a968b0b57e798fe2b657571c09bdd8e5ae29ed160a314e3d4311ceb8274ce3520b017d3e6145da77f6fe41a1434966a6445adf38c328b2443be7f1cb86c
Malware Config
Extracted
https://www.empresaweb.com.br/bootstrap/ZDuT5jT0N35ssN/
http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/mFTZ50JsmKq/
https://vietroll.vn/wp-content/fMgN4vYD1/
http://greycoconut.com/edm/X9xZ/
Extracted
emotet
Epoch5
103.71.99.57:8080
103.224.241.74:8080
157.245.111.0:8080
37.44.244.177:8080
103.41.204.169:8080
64.227.55.231:8080
103.254.12.236:7080
103.85.95.4:8080
157.230.99.206:8080
165.22.254.236:8080
85.214.67.203:8080
54.37.228.122:443
195.77.239.39:8080
128.199.217.206:443
190.145.8.4:443
165.232.185.110:8080
188.165.79.151:443
178.62.112.199:8080
54.37.106.167:8080
104.244.79.94:443
43.129.209.178:443
87.106.97.83:7080
202.134.4.210:7080
178.238.225.252:8080
198.199.70.22:8080
62.171.178.147:8080
175.126.176.79:8080
128.199.242.164:8080
88.217.172.165:8080
104.248.225.227:8080
85.25.120.45:8080
139.196.72.155:8080
188.225.32.231:4143
202.29.239.162:443
103.126.216.86:443
210.57.209.142:8080
93.104.209.107:8080
196.44.98.190:8080
5.253.30.17:7080
46.101.98.60:8080
103.56.149.105:8080
190.107.19.179:443
139.59.80.108:8080
36.67.23.59:443
78.47.204.80:443
83.229.80.93:8080
174.138.33.49:7080
118.98.72.86:443
37.187.114.15:8080
202.28.34.99:8080
Extracted
emotet
198.27.67.35:8080
190.107.19.180:8080
58.96.74.42:443
116.125.120.88:443
180.250.21.2:443
165.227.153.100:8080
62.141.45.103:443
134.209.164.181:8080
212.98.224.97:8080
159.65.163.220:443
128.199.93.156:7080
198.211.118.165:443
203.217.140.239:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1892 1660 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1556 1660 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1920 1660 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1916 1660 regsvr32.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 1556 regsvr32.exe 788 regsvr32.exe 1916 regsvr32.exe 1944 regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 2024 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1660 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 788 regsvr32.exe 1828 regsvr32.exe 1828 regsvr32.exe 1944 regsvr32.exe 1208 regsvr32.exe 1208 regsvr32.exe 1828 regsvr32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1660 EXCEL.EXE 1660 EXCEL.EXE 1660 EXCEL.EXE -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid process target process PID 1660 wrote to memory of 1892 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1892 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1892 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1892 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1892 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1892 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1892 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1556 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1556 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1556 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1556 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1556 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1556 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1556 1660 EXCEL.EXE regsvr32.exe PID 1556 wrote to memory of 788 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 788 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 788 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 788 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 788 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 788 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 788 1556 regsvr32.exe regsvr32.exe PID 788 wrote to memory of 1828 788 regsvr32.exe regsvr32.exe PID 788 wrote to memory of 1828 788 regsvr32.exe regsvr32.exe PID 788 wrote to memory of 1828 788 regsvr32.exe regsvr32.exe PID 788 wrote to memory of 1828 788 regsvr32.exe regsvr32.exe PID 788 wrote to memory of 1828 788 regsvr32.exe regsvr32.exe PID 1660 wrote to memory of 1920 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1920 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1920 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1920 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1920 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1920 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1920 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1916 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1916 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1916 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1916 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1916 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1916 1660 EXCEL.EXE regsvr32.exe PID 1660 wrote to memory of 1916 1660 EXCEL.EXE regsvr32.exe PID 1916 wrote to memory of 1944 1916 regsvr32.exe regsvr32.exe PID 1916 wrote to memory of 1944 1916 regsvr32.exe regsvr32.exe PID 1916 wrote to memory of 1944 1916 regsvr32.exe regsvr32.exe PID 1916 wrote to memory of 1944 1916 regsvr32.exe regsvr32.exe PID 1916 wrote to memory of 1944 1916 regsvr32.exe regsvr32.exe PID 1916 wrote to memory of 1944 1916 regsvr32.exe regsvr32.exe PID 1916 wrote to memory of 1944 1916 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 1208 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 1208 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 1208 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 1208 1944 regsvr32.exe regsvr32.exe PID 1944 wrote to memory of 1208 1944 regsvr32.exe regsvr32.exe PID 1828 wrote to memory of 432 1828 regsvr32.exe systeminfo.exe PID 1828 wrote to memory of 432 1828 regsvr32.exe systeminfo.exe PID 1828 wrote to memory of 432 1828 regsvr32.exe systeminfo.exe PID 1828 wrote to memory of 2024 1828 regsvr32.exe ipconfig.exe PID 1828 wrote to memory of 2024 1828 regsvr32.exe ipconfig.exe PID 1828 wrote to memory of 2024 1828 regsvr32.exe ipconfig.exe PID 1828 wrote to memory of 1420 1828 regsvr32.exe nltest.exe PID 1828 wrote to memory of 1420 1828 regsvr32.exe nltest.exe PID 1828 wrote to memory of 1420 1828 regsvr32.exe nltest.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\details_1250658.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci1.ocx2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci2.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/S ..\soci2.ocx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\TLCOfs\KkWSGNAlZq.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Gathers network information
-
C:\Windows\system32\nltest.exenltest /dclist:5⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci3.ocx2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci4.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/S ..\soci4.ocx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NtUvYjCokUko\AsKTXkYOBXhsFg.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
60KB
MD5589c442fc7a0c70dca927115a700d41e
SHA166a07dace3afbfd1aa07a47e6875beab62c4bb31
SHA2562e5cb72e9eb43baafb6c6bfcc573aac92f49a8064c483f9d378a9e8e781a526a
SHA5121b5fa79e52be495c42cf49618441fb7012e28c02e7a08a91da9213db3ab810f0e83485bc1dd5f625a47d0ba7cfcdd5ea50acc9a8dcebb39f048c40f01e94155b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5833101ffcfcff7a63e00bebba63015cd
SHA1c98c8f4c807fc3f4bef4b694de6fec87b4da7556
SHA2562d146080dc0346c77d671d7575afc456f16643cbcf1dfe59ab2a0298e0ed1492
SHA512f6581ac01eb91e3668f655cbae84a24b6a47398d25b3bcc10a3cb1579ffed186b3b15a6cc1f6b335619b502c12e76b9bd3679d040fa29726c8becb84b8eb0cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5533b9bd1c7ad4aad97b8ac279e2fc371
SHA1fb0a8f221b1b2c7ef5ec6f57d71ac6345407bf9d
SHA256335f5ab0b0d788d8bbec6ab9cf44c1df37216e92d4803005308c142c698fa85b
SHA5125682c31dc16bb018d2aae7908a1dda4f505f20c23fb4acc0d15d4c50a7625d4f8e62a9a23a37c8835fcfd1d774a0e415323c37487a2c8c08e2247ff8b61c61b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD50cefb53420d29d8acffa5ecbc80e50d2
SHA1c0657e4813578a1afb5881c70f7ad53936be6596
SHA256fa890f990289249c2a1d0e757cd136876c79b0b7d7cc0c7f2c71b9f533a9d38d
SHA5124e4295e67795357362ee25b5133a95132b68f419667d64339c5e49292dfd29e377c6688a73d1a6ff854c1c5df1281cde8d95e1dc189af48fd1a69826240bcdf0
-
C:\Users\Admin\soci2.ocxFilesize
524KB
MD5aa05198cc28eaaea29510273b2fc00da
SHA132eafb1112a9cbacbaec376dd54ec9f5376eeb89
SHA2563ace7a4640ac7eae4d6dac1b6812b4bae88c3c86e12c68c0b9c753f5d2e74e1f
SHA5128beb01b223a86c460cbb9a7b17c15d314675bc77d4f46ce74a9e9f6d6784eaa771a7754751f537fddd00478ad7e36ece856ed77d3e0b5cd4bede7f25ac7ff2da
-
C:\Users\Admin\soci4.ocxFilesize
524KB
MD589a80cdcf6ad4cd01156b3ee07e3bb50
SHA108beb6a93438a33ae80bd88a13df00925c50fb8a
SHA25634d3a6b993823ddec2514d39a8aaa795b2ef6d92d81ce0a37dbb578b6f7ac2e0
SHA5128fcb4830950a0b635a52526ad4f09bd92a93c9cf362d973cfaa01e29ee6fea37ce9bc2ebab6d36a8620d0286a4259baf4baeaceb5046fd029688b077ca028d99
-
\Users\Admin\soci2.ocxFilesize
524KB
MD5aa05198cc28eaaea29510273b2fc00da
SHA132eafb1112a9cbacbaec376dd54ec9f5376eeb89
SHA2563ace7a4640ac7eae4d6dac1b6812b4bae88c3c86e12c68c0b9c753f5d2e74e1f
SHA5128beb01b223a86c460cbb9a7b17c15d314675bc77d4f46ce74a9e9f6d6784eaa771a7754751f537fddd00478ad7e36ece856ed77d3e0b5cd4bede7f25ac7ff2da
-
\Users\Admin\soci2.ocxFilesize
524KB
MD5aa05198cc28eaaea29510273b2fc00da
SHA132eafb1112a9cbacbaec376dd54ec9f5376eeb89
SHA2563ace7a4640ac7eae4d6dac1b6812b4bae88c3c86e12c68c0b9c753f5d2e74e1f
SHA5128beb01b223a86c460cbb9a7b17c15d314675bc77d4f46ce74a9e9f6d6784eaa771a7754751f537fddd00478ad7e36ece856ed77d3e0b5cd4bede7f25ac7ff2da
-
\Users\Admin\soci4.ocxFilesize
524KB
MD589a80cdcf6ad4cd01156b3ee07e3bb50
SHA108beb6a93438a33ae80bd88a13df00925c50fb8a
SHA25634d3a6b993823ddec2514d39a8aaa795b2ef6d92d81ce0a37dbb578b6f7ac2e0
SHA5128fcb4830950a0b635a52526ad4f09bd92a93c9cf362d973cfaa01e29ee6fea37ce9bc2ebab6d36a8620d0286a4259baf4baeaceb5046fd029688b077ca028d99
-
\Users\Admin\soci4.ocxFilesize
524KB
MD589a80cdcf6ad4cd01156b3ee07e3bb50
SHA108beb6a93438a33ae80bd88a13df00925c50fb8a
SHA25634d3a6b993823ddec2514d39a8aaa795b2ef6d92d81ce0a37dbb578b6f7ac2e0
SHA5128fcb4830950a0b635a52526ad4f09bd92a93c9cf362d973cfaa01e29ee6fea37ce9bc2ebab6d36a8620d0286a4259baf4baeaceb5046fd029688b077ca028d99
-
memory/432-99-0x0000000000000000-mapping.dmp
-
memory/788-65-0x0000000000000000-mapping.dmp
-
memory/788-66-0x000007FEFC331000-0x000007FEFC333000-memory.dmpFilesize
8KB
-
memory/788-68-0x0000000180000000-0x0000000180030000-memory.dmpFilesize
192KB
-
memory/1208-88-0x0000000000000000-mapping.dmp
-
memory/1420-102-0x0000000000000000-mapping.dmp
-
memory/1556-61-0x0000000000000000-mapping.dmp
-
memory/1660-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1660-54-0x000000002FFB1000-0x000000002FFB4000-memory.dmpFilesize
12KB
-
memory/1660-93-0x000000007296D000-0x0000000072978000-memory.dmpFilesize
44KB
-
memory/1660-58-0x000000007296D000-0x0000000072978000-memory.dmpFilesize
44KB
-
memory/1660-57-0x0000000076781000-0x0000000076783000-memory.dmpFilesize
8KB
-
memory/1660-55-0x0000000071981000-0x0000000071983000-memory.dmpFilesize
8KB
-
memory/1828-100-0x0000000001DB0000-0x0000000001DD3000-memory.dmpFilesize
140KB
-
memory/1828-103-0x0000000001DB0000-0x0000000001DD3000-memory.dmpFilesize
140KB
-
memory/1828-71-0x0000000000000000-mapping.dmp
-
memory/1892-59-0x0000000000000000-mapping.dmp
-
memory/1916-78-0x0000000000000000-mapping.dmp
-
memory/1920-76-0x0000000000000000-mapping.dmp
-
memory/1944-82-0x0000000000000000-mapping.dmp
-
memory/2024-101-0x0000000000000000-mapping.dmp