Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/11/2022, 13:41
Behavioral task
behavioral1
Sample
0311.xls
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0311.xls
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
0311.xls
-
Size
217KB
-
MD5
f6895e2267fc5ef1a31fd5dd4495fd5b
-
SHA1
ea86e973131a134c64150bb2a61440926f6e32a8
-
SHA256
5e885180e31c3690ed6761b181919f985140bd173e35a444ea67450ce587dc15
-
SHA512
97fd3bd4dfb31f75a5c4dfdc28dfcb7ed394d1b653153a69f0f73c50aec4aa866721ad48425665081c2cbde28be7014d6619a1ab360db8362545dcedfe153dcf
-
SSDEEP
6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmL:bbGUMVWlbL
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
https://aprendeconmireia.com/images/wBu/
xlm40.dropper
http://updailymail.com/cgi-bin/gBYmfqRi2utIS2n/
xlm40.dropper
https://akuntansi.itny.ac.id/asset/9aVFvYeaSKOhGBSLx/
xlm40.dropper
http://swiftwebbox.com/cgi-bin/vNqoMtQilpysJYRwtGu/
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 288 860 regsvr32.exe 26 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2024 860 regsvr32.exe 26 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1000 860 regsvr32.exe 26 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1848 860 regsvr32.exe 26 -
Downloads MZ/PE file
-
Loads dropped DLL 8 IoCs
pid Process 288 regsvr32.exe 540 regsvr32.exe 2024 regsvr32.exe 1804 regsvr32.exe 1000 regsvr32.exe 916 regsvr32.exe 1848 regsvr32.exe 1432 regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 860 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 540 regsvr32.exe 640 regsvr32.exe 640 regsvr32.exe 1804 regsvr32.exe 1852 regsvr32.exe 1852 regsvr32.exe 916 regsvr32.exe 1340 regsvr32.exe 1340 regsvr32.exe 1432 regsvr32.exe 1644 regsvr32.exe 1644 regsvr32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 288 860 EXCEL.EXE 29 PID 860 wrote to memory of 288 860 EXCEL.EXE 29 PID 860 wrote to memory of 288 860 EXCEL.EXE 29 PID 860 wrote to memory of 288 860 EXCEL.EXE 29 PID 860 wrote to memory of 288 860 EXCEL.EXE 29 PID 860 wrote to memory of 288 860 EXCEL.EXE 29 PID 860 wrote to memory of 288 860 EXCEL.EXE 29 PID 288 wrote to memory of 540 288 regsvr32.exe 30 PID 288 wrote to memory of 540 288 regsvr32.exe 30 PID 288 wrote to memory of 540 288 regsvr32.exe 30 PID 288 wrote to memory of 540 288 regsvr32.exe 30 PID 288 wrote to memory of 540 288 regsvr32.exe 30 PID 288 wrote to memory of 540 288 regsvr32.exe 30 PID 288 wrote to memory of 540 288 regsvr32.exe 30 PID 540 wrote to memory of 640 540 regsvr32.exe 31 PID 540 wrote to memory of 640 540 regsvr32.exe 31 PID 540 wrote to memory of 640 540 regsvr32.exe 31 PID 540 wrote to memory of 640 540 regsvr32.exe 31 PID 540 wrote to memory of 640 540 regsvr32.exe 31 PID 860 wrote to memory of 2024 860 EXCEL.EXE 32 PID 860 wrote to memory of 2024 860 EXCEL.EXE 32 PID 860 wrote to memory of 2024 860 EXCEL.EXE 32 PID 860 wrote to memory of 2024 860 EXCEL.EXE 32 PID 860 wrote to memory of 2024 860 EXCEL.EXE 32 PID 860 wrote to memory of 2024 860 EXCEL.EXE 32 PID 860 wrote to memory of 2024 860 EXCEL.EXE 32 PID 2024 wrote to memory of 1804 2024 regsvr32.exe 33 PID 2024 wrote to memory of 1804 2024 regsvr32.exe 33 PID 2024 wrote to memory of 1804 2024 regsvr32.exe 33 PID 2024 wrote to memory of 1804 2024 regsvr32.exe 33 PID 2024 wrote to memory of 1804 2024 regsvr32.exe 33 PID 2024 wrote to memory of 1804 2024 regsvr32.exe 33 PID 2024 wrote to memory of 1804 2024 regsvr32.exe 33 PID 1804 wrote to memory of 1852 1804 regsvr32.exe 34 PID 1804 wrote to memory of 1852 1804 regsvr32.exe 34 PID 1804 wrote to memory of 1852 1804 regsvr32.exe 34 PID 1804 wrote to memory of 1852 1804 regsvr32.exe 34 PID 1804 wrote to memory of 1852 1804 regsvr32.exe 34 PID 860 wrote to memory of 1000 860 EXCEL.EXE 35 PID 860 wrote to memory of 1000 860 EXCEL.EXE 35 PID 860 wrote to memory of 1000 860 EXCEL.EXE 35 PID 860 wrote to memory of 1000 860 EXCEL.EXE 35 PID 860 wrote to memory of 1000 860 EXCEL.EXE 35 PID 860 wrote to memory of 1000 860 EXCEL.EXE 35 PID 860 wrote to memory of 1000 860 EXCEL.EXE 35 PID 1000 wrote to memory of 916 1000 regsvr32.exe 36 PID 1000 wrote to memory of 916 1000 regsvr32.exe 36 PID 1000 wrote to memory of 916 1000 regsvr32.exe 36 PID 1000 wrote to memory of 916 1000 regsvr32.exe 36 PID 1000 wrote to memory of 916 1000 regsvr32.exe 36 PID 1000 wrote to memory of 916 1000 regsvr32.exe 36 PID 1000 wrote to memory of 916 1000 regsvr32.exe 36 PID 916 wrote to memory of 1340 916 regsvr32.exe 37 PID 916 wrote to memory of 1340 916 regsvr32.exe 37 PID 916 wrote to memory of 1340 916 regsvr32.exe 37 PID 916 wrote to memory of 1340 916 regsvr32.exe 37 PID 916 wrote to memory of 1340 916 regsvr32.exe 37 PID 860 wrote to memory of 1848 860 EXCEL.EXE 38 PID 860 wrote to memory of 1848 860 EXCEL.EXE 38 PID 860 wrote to memory of 1848 860 EXCEL.EXE 38 PID 860 wrote to memory of 1848 860 EXCEL.EXE 38 PID 860 wrote to memory of 1848 860 EXCEL.EXE 38 PID 860 wrote to memory of 1848 860 EXCEL.EXE 38 PID 860 wrote to memory of 1848 860 EXCEL.EXE 38
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\0311.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv1.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NjPNlmEQ\QOjuzhbpmcyi.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:640
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv2.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\LFZPrayATYw\PLzDUqIeIY.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv3.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\KLjhYpdaczcL\QTDBZGfrnNoGDzY.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
PID:1848 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv4.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1432 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NpBQXDqACPBggLD\JRGXhqVqdty.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
818KB
MD5d9fd8f201f796ab318f478fd9c76804c
SHA1788d4ef141339b72381717c35ef8b6349841dae9
SHA2565363f23d42383a390bf5dc39e6f34e1f5febdaaa6e8fb1c5a38a7fa03a5ea0a8
SHA5125e0891c04f0db03d34364c6cbc2703cb18e64e2f52b571458b348c055c6692600422868546d71119a6607f3c9949441a949cde171aa20b732048c4b051b10985
-
Filesize
818KB
MD51e0fbed0c0dec7ce52035d57038b3630
SHA11015353dc5d1c0c2f4ce6678131ab087615b2b87
SHA256eb0da63e432d154ee120b7afb3d8bf83564ad7fc7bf4719cb8d73e3c1b60145a
SHA5129696c18bfe4763c7d99def3c8f3ca077da11e87663ac345aa790f7f3ae007d77c6b99a119f7f8860e22672ab0015b6fba599c29909990083ceca974db242c3a4
-
Filesize
818KB
MD5031911e41da16f6ff2fab0a2611d12e5
SHA1fc0885a7661041dad5ba76121db972ec3b7cb851
SHA256f545897f6677b7f0d205c08ff6a38e807e495c89d51f588f6b13d427df90992d
SHA51204ae8d4cf27c165288ddc4151c8d6649780cd9e5f68b900949325c65a8f9e8f08e7b8d558ebf3b08eaf18af90e1c5b725c48383830c68e082827d24af24f33e0
-
Filesize
818KB
MD549b1abbc6a8660d5dcee74f53f9f64b2
SHA1748cde3a1a4c9df6c1ab06bc1670eae1eaac9268
SHA256c5a61d7a8b47c419e36d49caad1930fb769dbad81c00dbbb073a1779d6f658ec
SHA512b6c6546abbb3bf7cd328687b70069df633f603d6a031111ae65385303e61002e4e00543119bef0e450963e775c873beda1a7574bbd7e63c872d261da02d4dbc0
-
Filesize
818KB
MD5d9fd8f201f796ab318f478fd9c76804c
SHA1788d4ef141339b72381717c35ef8b6349841dae9
SHA2565363f23d42383a390bf5dc39e6f34e1f5febdaaa6e8fb1c5a38a7fa03a5ea0a8
SHA5125e0891c04f0db03d34364c6cbc2703cb18e64e2f52b571458b348c055c6692600422868546d71119a6607f3c9949441a949cde171aa20b732048c4b051b10985
-
Filesize
818KB
MD5d9fd8f201f796ab318f478fd9c76804c
SHA1788d4ef141339b72381717c35ef8b6349841dae9
SHA2565363f23d42383a390bf5dc39e6f34e1f5febdaaa6e8fb1c5a38a7fa03a5ea0a8
SHA5125e0891c04f0db03d34364c6cbc2703cb18e64e2f52b571458b348c055c6692600422868546d71119a6607f3c9949441a949cde171aa20b732048c4b051b10985
-
Filesize
818KB
MD51e0fbed0c0dec7ce52035d57038b3630
SHA11015353dc5d1c0c2f4ce6678131ab087615b2b87
SHA256eb0da63e432d154ee120b7afb3d8bf83564ad7fc7bf4719cb8d73e3c1b60145a
SHA5129696c18bfe4763c7d99def3c8f3ca077da11e87663ac345aa790f7f3ae007d77c6b99a119f7f8860e22672ab0015b6fba599c29909990083ceca974db242c3a4
-
Filesize
818KB
MD51e0fbed0c0dec7ce52035d57038b3630
SHA11015353dc5d1c0c2f4ce6678131ab087615b2b87
SHA256eb0da63e432d154ee120b7afb3d8bf83564ad7fc7bf4719cb8d73e3c1b60145a
SHA5129696c18bfe4763c7d99def3c8f3ca077da11e87663ac345aa790f7f3ae007d77c6b99a119f7f8860e22672ab0015b6fba599c29909990083ceca974db242c3a4
-
Filesize
818KB
MD5031911e41da16f6ff2fab0a2611d12e5
SHA1fc0885a7661041dad5ba76121db972ec3b7cb851
SHA256f545897f6677b7f0d205c08ff6a38e807e495c89d51f588f6b13d427df90992d
SHA51204ae8d4cf27c165288ddc4151c8d6649780cd9e5f68b900949325c65a8f9e8f08e7b8d558ebf3b08eaf18af90e1c5b725c48383830c68e082827d24af24f33e0
-
Filesize
818KB
MD5031911e41da16f6ff2fab0a2611d12e5
SHA1fc0885a7661041dad5ba76121db972ec3b7cb851
SHA256f545897f6677b7f0d205c08ff6a38e807e495c89d51f588f6b13d427df90992d
SHA51204ae8d4cf27c165288ddc4151c8d6649780cd9e5f68b900949325c65a8f9e8f08e7b8d558ebf3b08eaf18af90e1c5b725c48383830c68e082827d24af24f33e0
-
Filesize
818KB
MD549b1abbc6a8660d5dcee74f53f9f64b2
SHA1748cde3a1a4c9df6c1ab06bc1670eae1eaac9268
SHA256c5a61d7a8b47c419e36d49caad1930fb769dbad81c00dbbb073a1779d6f658ec
SHA512b6c6546abbb3bf7cd328687b70069df633f603d6a031111ae65385303e61002e4e00543119bef0e450963e775c873beda1a7574bbd7e63c872d261da02d4dbc0
-
Filesize
818KB
MD549b1abbc6a8660d5dcee74f53f9f64b2
SHA1748cde3a1a4c9df6c1ab06bc1670eae1eaac9268
SHA256c5a61d7a8b47c419e36d49caad1930fb769dbad81c00dbbb073a1779d6f658ec
SHA512b6c6546abbb3bf7cd328687b70069df633f603d6a031111ae65385303e61002e4e00543119bef0e450963e775c873beda1a7574bbd7e63c872d261da02d4dbc0