d00ef6796031f818b0a66b5929d7e7741378b03dd8a6fe18193de9124ca03c11

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-09-2022 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FICHE IMMEUBLE FI-75115-01EN 3 RUE CLODION PARIS 75015.xlsm
Size

3.5MB
MD5

2074889942a23c15bb70bc2446f81d2d
SHA1

1bf02a1372ce0f9588d917c0481ea9a6178b4572
SHA256

d00ef6796031f818b0a66b5929d7e7741378b03dd8a6fe18193de9124ca03c11
SHA512

e7b867e54f21c5e1ed3cf7b5f6a3c824d84f8dcb178f747e52f50c27a35487058a41c5ded0c4c5459e729fef227b8c734b1d2ffb34b4c8063d3117aca0c6c137
SSDEEP

49152:OiZzi4qQ1XpDxZcoTp4DU0DSkR5AT15WoNoTD6iai//6ew6/BDe8FKmzYuJd3p/P:jVcNzDZRkPWoQD6+//6eX/BGmGgB

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370688138"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11A381A1-3B1D-11ED-A50E-C6457FCBF3CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{DAEDB2EE-2745-4FBC-AA53-E98F24161426}\2.0\HELPDIR	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAEDB2EE-2745-4FBC-AA53-E98F24161426}\2.0\0\win32	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAEDB2EE-2745-4FBC-AA53-E98F24161426}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Excel8.0\\MSForms.exd"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{DAEDB2EE-2745-4FBC-AA53-E98F24161426}\2.0	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAEDB2EE-2745-4FBC-AA53-E98F24161426}\2.0\0	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{DAEDB2EE-2745-4FBC-AA53-E98F24161426}\2.0\FLAGS	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAEDB2EE-2745-4FBC-AA53-E98F24161426}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1788 EXCEL.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1056 iexplore.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXE

pid process

1788 EXCEL.EXE
1788 EXCEL.EXE
1788 EXCEL.EXE
1788 EXCEL.EXE
1788 EXCEL.EXE
1056 iexplore.exe
1056 iexplore.exe
1648 IEXPLORE.EXE
1648 IEXPLORE.EXE

pid	process
1788	EXCEL.EXE

pid	process
1056	iexplore.exe

pid	process
1788	EXCEL.EXE
1788	EXCEL.EXE
1788	EXCEL.EXE
1788	EXCEL.EXE
1788	EXCEL.EXE
1056	iexplore.exe
1056	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXEiexplore.exe

description	pid	process	target process
PID 1788 wrote to memory of 1472	1788	EXCEL.EXE	splwow64.exe
PID 1788 wrote to memory of 1472	1788	EXCEL.EXE	splwow64.exe
PID 1788 wrote to memory of 1472	1788	EXCEL.EXE	splwow64.exe
PID 1788 wrote to memory of 1472	1788	EXCEL.EXE	splwow64.exe
PID 1056 wrote to memory of 1648	1056	iexplore.exe	IEXPLORE.EXE
PID 1056 wrote to memory of 1648	1056	iexplore.exe	IEXPLORE.EXE
PID 1056 wrote to memory of 1648	1056	iexplore.exe	IEXPLORE.EXE
PID 1056 wrote to memory of 1648	1056	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\FICHE IMMEUBLE FI-75115-01EN 3 RUE CLODION PARIS 75015.xlsm"
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QPJ9ZDYI.txt
Filesize
608B

MD5
f0b669bb74aca7485639b2349fca3afa

SHA1
6baa38afe3d18b6db230904b474db152b3a63962

SHA256
31212ae8339db57cc8893766f0d0ecad8ee78b24716d8982c09164a6c1699131

SHA512
9d86a08319b9fe091985d271f6d6acddb37dcec343de2305e50685301ec70d7b07e42e33be2fc429b8d0f6d0a3ea67eb467d9d972ec0313d64d5949ad542dde9

Download Submit
memory/1472-59-0x0000000000000000-mapping.dmp

Download
memory/1472-60-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download
memory/1788-54-0x000000002FB51000-0x000000002FB54000-memory.dmp

Filesize
12KB

Download
memory/1788-55-0x0000000071731000-0x0000000071733000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1788-57-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1788-58-0x000000007271D000-0x0000000072728000-memory.dmp

Filesize
44KB

Download
memory/1788-62-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-61-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-64-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-63-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-65-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-66-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-67-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-68-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-70-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-71-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-69-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-73-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-74-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-72-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-76-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-75-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-77-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-78-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-79-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-81-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-80-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-82-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-83-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-85-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-84-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-87-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-88-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-89-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-86-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-90-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-91-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-92-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-93-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-94-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-97-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-96-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-95-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-98-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-99-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-100-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-101-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-102-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-103-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-104-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-105-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-106-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-108-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-107-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-109-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-111-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-110-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-112-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-113-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-114-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-115-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-117-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-116-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-118-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-119-0x00000000063E9000-0x00000000063ED000-memory.dmp

Filesize
16KB

Download
memory/1788-235-0x00000000066A5000-0x00000000066A7000-memory.dmp

Filesize
8KB

Download
memory/1788-294-0x00000000066A5000-0x00000000066A7000-memory.dmp

Filesize
8KB

Download
memory/1788-295-0x000000007271D000-0x0000000072728000-memory.dmp

Filesize
44KB

Download