Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/11/2022, 22:44
Behavioral task
behavioral1
Sample
03112022.xls
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
03112022.xls
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
03112022.xls
-
Size
217KB
-
MD5
2cbd1cdca247f0f28fc63a5c0e0b13d5
-
SHA1
966e13dfaa1080606d3f47e8cb6c3abd5568b847
-
SHA256
64ff2f53597a590af0608eb012ffd3320f647949019b806da2cbf6fed1eae264
-
SHA512
5f5379a66fa9aacb0563c25ed18dd56e605836b4a4813dc8694df1097183878d2d072ef6530832c0319b7f611ab2c96e68265b52d9e29996fcc6ab3ea62ebad6
-
SSDEEP
6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgJyY+TAQXTHGUMEyP5p6f5jQm1:4bGUMVWlb1
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
http://ruitaiwz.com/wp-admin/sV1NeVxLDiHJ1xm/
xlm40.dropper
http://wordpress.xinmoshiwang.com/list/cRIH9Bd/
xlm40.dropper
http://cultura.educad.pe/wp-content/A86I7QxwuEZV/
xlm40.dropper
http://voinet.ca/cgi-bin/RXDWHpi8dHHZf8/
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1816 1584 regsvr32.exe 25 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 656 1584 regsvr32.exe 25 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1188 1584 regsvr32.exe 25 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1144 1584 regsvr32.exe 25 -
Downloads MZ/PE file
-
Loads dropped DLL 6 IoCs
pid Process 1816 regsvr32.exe 2036 regsvr32.exe 656 regsvr32.exe 1980 regsvr32.exe 1188 regsvr32.exe 1196 regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1584 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2036 regsvr32.exe 1404 regsvr32.exe 1404 regsvr32.exe 1980 regsvr32.exe 820 regsvr32.exe 820 regsvr32.exe 1196 regsvr32.exe 1580 regsvr32.exe 1580 regsvr32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1816 1584 EXCEL.EXE 28 PID 1584 wrote to memory of 1816 1584 EXCEL.EXE 28 PID 1584 wrote to memory of 1816 1584 EXCEL.EXE 28 PID 1584 wrote to memory of 1816 1584 EXCEL.EXE 28 PID 1584 wrote to memory of 1816 1584 EXCEL.EXE 28 PID 1584 wrote to memory of 1816 1584 EXCEL.EXE 28 PID 1584 wrote to memory of 1816 1584 EXCEL.EXE 28 PID 1816 wrote to memory of 2036 1816 regsvr32.exe 29 PID 1816 wrote to memory of 2036 1816 regsvr32.exe 29 PID 1816 wrote to memory of 2036 1816 regsvr32.exe 29 PID 1816 wrote to memory of 2036 1816 regsvr32.exe 29 PID 1816 wrote to memory of 2036 1816 regsvr32.exe 29 PID 1816 wrote to memory of 2036 1816 regsvr32.exe 29 PID 1816 wrote to memory of 2036 1816 regsvr32.exe 29 PID 2036 wrote to memory of 1404 2036 regsvr32.exe 30 PID 2036 wrote to memory of 1404 2036 regsvr32.exe 30 PID 2036 wrote to memory of 1404 2036 regsvr32.exe 30 PID 2036 wrote to memory of 1404 2036 regsvr32.exe 30 PID 2036 wrote to memory of 1404 2036 regsvr32.exe 30 PID 1584 wrote to memory of 656 1584 EXCEL.EXE 31 PID 1584 wrote to memory of 656 1584 EXCEL.EXE 31 PID 1584 wrote to memory of 656 1584 EXCEL.EXE 31 PID 1584 wrote to memory of 656 1584 EXCEL.EXE 31 PID 1584 wrote to memory of 656 1584 EXCEL.EXE 31 PID 1584 wrote to memory of 656 1584 EXCEL.EXE 31 PID 1584 wrote to memory of 656 1584 EXCEL.EXE 31 PID 656 wrote to memory of 1980 656 regsvr32.exe 32 PID 656 wrote to memory of 1980 656 regsvr32.exe 32 PID 656 wrote to memory of 1980 656 regsvr32.exe 32 PID 656 wrote to memory of 1980 656 regsvr32.exe 32 PID 656 wrote to memory of 1980 656 regsvr32.exe 32 PID 656 wrote to memory of 1980 656 regsvr32.exe 32 PID 656 wrote to memory of 1980 656 regsvr32.exe 32 PID 1980 wrote to memory of 820 1980 regsvr32.exe 33 PID 1980 wrote to memory of 820 1980 regsvr32.exe 33 PID 1980 wrote to memory of 820 1980 regsvr32.exe 33 PID 1980 wrote to memory of 820 1980 regsvr32.exe 33 PID 1980 wrote to memory of 820 1980 regsvr32.exe 33 PID 1584 wrote to memory of 1188 1584 EXCEL.EXE 34 PID 1584 wrote to memory of 1188 1584 EXCEL.EXE 34 PID 1584 wrote to memory of 1188 1584 EXCEL.EXE 34 PID 1584 wrote to memory of 1188 1584 EXCEL.EXE 34 PID 1584 wrote to memory of 1188 1584 EXCEL.EXE 34 PID 1584 wrote to memory of 1188 1584 EXCEL.EXE 34 PID 1584 wrote to memory of 1188 1584 EXCEL.EXE 34 PID 1188 wrote to memory of 1196 1188 regsvr32.exe 35 PID 1188 wrote to memory of 1196 1188 regsvr32.exe 35 PID 1188 wrote to memory of 1196 1188 regsvr32.exe 35 PID 1188 wrote to memory of 1196 1188 regsvr32.exe 35 PID 1188 wrote to memory of 1196 1188 regsvr32.exe 35 PID 1188 wrote to memory of 1196 1188 regsvr32.exe 35 PID 1188 wrote to memory of 1196 1188 regsvr32.exe 35 PID 1196 wrote to memory of 1580 1196 regsvr32.exe 36 PID 1196 wrote to memory of 1580 1196 regsvr32.exe 36 PID 1196 wrote to memory of 1580 1196 regsvr32.exe 36 PID 1196 wrote to memory of 1580 1196 regsvr32.exe 36 PID 1196 wrote to memory of 1580 1196 regsvr32.exe 36 PID 1584 wrote to memory of 1144 1584 EXCEL.EXE 37 PID 1584 wrote to memory of 1144 1584 EXCEL.EXE 37 PID 1584 wrote to memory of 1144 1584 EXCEL.EXE 37 PID 1584 wrote to memory of 1144 1584 EXCEL.EXE 37 PID 1584 wrote to memory of 1144 1584 EXCEL.EXE 37 PID 1584 wrote to memory of 1144 1584 EXCEL.EXE 37 PID 1584 wrote to memory of 1144 1584 EXCEL.EXE 37
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\03112022.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv1.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JAtWCUxyr\fagRz.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1404
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv2.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\DoRpRiVMMVyEYaX\bzMaoHUsmPVZNV.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:820
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv3.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\YUtLWpZB\PnFmzBavC.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
PID:1144
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
727KB
MD52817cc6c71db526b978c3188c0869ebb
SHA1a11b5d81591c4f6b57d2a2aac94db70c3f8eca8d
SHA25622fe1991115d9ed9aaf7e6994b0fe0965a9f1d5ce035b43e57bed7f7e23f1069
SHA512f1c461f8b735b3d32ca9f9432ae3eed764f02eb8de311af408bc243e61e8ec6632bf4723d9e16ac07abdfb6572da440e690357671462e6d9f8a97f5e7585578d
-
Filesize
727KB
MD5d9b469ea18de530d3bb94a10220c4d82
SHA1af5a16c5e4c418c7491b684c0f21aa636a4751c0
SHA2568d3bb8fd36d20868dbb952eff9dd1c6ee326064dacdb44ea4e0b81dc68a4b138
SHA5120f8190ba901c7f46e770e151a7628d964faa48276fec17b92553a51ef4c55995ac30e16a401d7aa190d146e538470572fb392c59999556c66895bc7cebea497a
-
Filesize
727KB
MD587a7519ba6ac25838a41e2d0fa606d02
SHA19e2f2255c42909fa4f94c92024c0ef3a3843cecd
SHA256443ee26c33be809e9443abeb41658e4811d68da4e705eba9ac5941110fdc4f9a
SHA512db0ac2bd3dc6b4a1d975cc8a39ff913e414983ddc3cdbbaee39f83ed5e2f8ca5e043290de1e709e451061f22d83d37f2ac70f72d759b57dcc99976799f1840d1
-
Filesize
727KB
MD52817cc6c71db526b978c3188c0869ebb
SHA1a11b5d81591c4f6b57d2a2aac94db70c3f8eca8d
SHA25622fe1991115d9ed9aaf7e6994b0fe0965a9f1d5ce035b43e57bed7f7e23f1069
SHA512f1c461f8b735b3d32ca9f9432ae3eed764f02eb8de311af408bc243e61e8ec6632bf4723d9e16ac07abdfb6572da440e690357671462e6d9f8a97f5e7585578d
-
Filesize
727KB
MD52817cc6c71db526b978c3188c0869ebb
SHA1a11b5d81591c4f6b57d2a2aac94db70c3f8eca8d
SHA25622fe1991115d9ed9aaf7e6994b0fe0965a9f1d5ce035b43e57bed7f7e23f1069
SHA512f1c461f8b735b3d32ca9f9432ae3eed764f02eb8de311af408bc243e61e8ec6632bf4723d9e16ac07abdfb6572da440e690357671462e6d9f8a97f5e7585578d
-
Filesize
727KB
MD5d9b469ea18de530d3bb94a10220c4d82
SHA1af5a16c5e4c418c7491b684c0f21aa636a4751c0
SHA2568d3bb8fd36d20868dbb952eff9dd1c6ee326064dacdb44ea4e0b81dc68a4b138
SHA5120f8190ba901c7f46e770e151a7628d964faa48276fec17b92553a51ef4c55995ac30e16a401d7aa190d146e538470572fb392c59999556c66895bc7cebea497a
-
Filesize
727KB
MD5d9b469ea18de530d3bb94a10220c4d82
SHA1af5a16c5e4c418c7491b684c0f21aa636a4751c0
SHA2568d3bb8fd36d20868dbb952eff9dd1c6ee326064dacdb44ea4e0b81dc68a4b138
SHA5120f8190ba901c7f46e770e151a7628d964faa48276fec17b92553a51ef4c55995ac30e16a401d7aa190d146e538470572fb392c59999556c66895bc7cebea497a
-
Filesize
727KB
MD587a7519ba6ac25838a41e2d0fa606d02
SHA19e2f2255c42909fa4f94c92024c0ef3a3843cecd
SHA256443ee26c33be809e9443abeb41658e4811d68da4e705eba9ac5941110fdc4f9a
SHA512db0ac2bd3dc6b4a1d975cc8a39ff913e414983ddc3cdbbaee39f83ed5e2f8ca5e043290de1e709e451061f22d83d37f2ac70f72d759b57dcc99976799f1840d1
-
Filesize
727KB
MD587a7519ba6ac25838a41e2d0fa606d02
SHA19e2f2255c42909fa4f94c92024c0ef3a3843cecd
SHA256443ee26c33be809e9443abeb41658e4811d68da4e705eba9ac5941110fdc4f9a
SHA512db0ac2bd3dc6b4a1d975cc8a39ff913e414983ddc3cdbbaee39f83ed5e2f8ca5e043290de1e709e451061f22d83d37f2ac70f72d759b57dcc99976799f1840d1