Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/11/2022, 18:49
Behavioral task
behavioral1
Sample
0311.xls
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0311.xls
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0311.xls
-
Size
217KB
-
MD5
ebfaf79c4f49cee641af4396bd4c77b6
-
SHA1
3cbfd1f9c9dacb71f5bfea4c771fdb2e7e1d3983
-
SHA256
793264ce793c1653e30e9102042f9613e125ba7acc582d250c8e50a667c18bfc
-
SHA512
ad2c0c8d8a054ba842407fe1fc28df180991b81923164a3d9a57c923b6d603db800b72fe0880e718a7206899aefb557d36d15a749ecce0f777645f82a49c5b21
-
SSDEEP
6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmL:bbGUMVWlbL
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
https://aprendeconmireia.com/images/wBu/
xlm40.dropper
http://updailymail.com/cgi-bin/gBYmfqRi2utIS2n/
xlm40.dropper
https://akuntansi.itny.ac.id/asset/9aVFvYeaSKOhGBSLx/
xlm40.dropper
http://swiftwebbox.com/cgi-bin/vNqoMtQilpysJYRwtGu/
Extracted
Family
emotet
Botnet
Epoch5
C2
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
ecs1.plain
eck1.plain
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1416 1196 regsvr32.exe 26 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 524 1196 regsvr32.exe 26 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 788 1196 regsvr32.exe 26 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 320 1196 regsvr32.exe 26 -
Downloads MZ/PE file
-
Loads dropped DLL 8 IoCs
pid Process 1416 regsvr32.exe 1796 regsvr32.exe 524 regsvr32.exe 1408 regsvr32.exe 788 regsvr32.exe 1064 regsvr32.exe 320 regsvr32.exe 632 regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1196 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1796 regsvr32.exe 1540 regsvr32.exe 1540 regsvr32.exe 1408 regsvr32.exe 1972 regsvr32.exe 1972 regsvr32.exe 1064 regsvr32.exe 1600 regsvr32.exe 1600 regsvr32.exe 632 regsvr32.exe 1648 regsvr32.exe 1648 regsvr32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1416 1196 EXCEL.EXE 29 PID 1196 wrote to memory of 1416 1196 EXCEL.EXE 29 PID 1196 wrote to memory of 1416 1196 EXCEL.EXE 29 PID 1196 wrote to memory of 1416 1196 EXCEL.EXE 29 PID 1196 wrote to memory of 1416 1196 EXCEL.EXE 29 PID 1196 wrote to memory of 1416 1196 EXCEL.EXE 29 PID 1196 wrote to memory of 1416 1196 EXCEL.EXE 29 PID 1416 wrote to memory of 1796 1416 regsvr32.exe 30 PID 1416 wrote to memory of 1796 1416 regsvr32.exe 30 PID 1416 wrote to memory of 1796 1416 regsvr32.exe 30 PID 1416 wrote to memory of 1796 1416 regsvr32.exe 30 PID 1416 wrote to memory of 1796 1416 regsvr32.exe 30 PID 1416 wrote to memory of 1796 1416 regsvr32.exe 30 PID 1416 wrote to memory of 1796 1416 regsvr32.exe 30 PID 1796 wrote to memory of 1540 1796 regsvr32.exe 31 PID 1796 wrote to memory of 1540 1796 regsvr32.exe 31 PID 1796 wrote to memory of 1540 1796 regsvr32.exe 31 PID 1796 wrote to memory of 1540 1796 regsvr32.exe 31 PID 1796 wrote to memory of 1540 1796 regsvr32.exe 31 PID 1196 wrote to memory of 524 1196 EXCEL.EXE 32 PID 1196 wrote to memory of 524 1196 EXCEL.EXE 32 PID 1196 wrote to memory of 524 1196 EXCEL.EXE 32 PID 1196 wrote to memory of 524 1196 EXCEL.EXE 32 PID 1196 wrote to memory of 524 1196 EXCEL.EXE 32 PID 1196 wrote to memory of 524 1196 EXCEL.EXE 32 PID 1196 wrote to memory of 524 1196 EXCEL.EXE 32 PID 524 wrote to memory of 1408 524 regsvr32.exe 33 PID 524 wrote to memory of 1408 524 regsvr32.exe 33 PID 524 wrote to memory of 1408 524 regsvr32.exe 33 PID 524 wrote to memory of 1408 524 regsvr32.exe 33 PID 524 wrote to memory of 1408 524 regsvr32.exe 33 PID 524 wrote to memory of 1408 524 regsvr32.exe 33 PID 524 wrote to memory of 1408 524 regsvr32.exe 33 PID 1408 wrote to memory of 1972 1408 regsvr32.exe 34 PID 1408 wrote to memory of 1972 1408 regsvr32.exe 34 PID 1408 wrote to memory of 1972 1408 regsvr32.exe 34 PID 1408 wrote to memory of 1972 1408 regsvr32.exe 34 PID 1408 wrote to memory of 1972 1408 regsvr32.exe 34 PID 1196 wrote to memory of 788 1196 EXCEL.EXE 35 PID 1196 wrote to memory of 788 1196 EXCEL.EXE 35 PID 1196 wrote to memory of 788 1196 EXCEL.EXE 35 PID 1196 wrote to memory of 788 1196 EXCEL.EXE 35 PID 1196 wrote to memory of 788 1196 EXCEL.EXE 35 PID 1196 wrote to memory of 788 1196 EXCEL.EXE 35 PID 1196 wrote to memory of 788 1196 EXCEL.EXE 35 PID 788 wrote to memory of 1064 788 regsvr32.exe 36 PID 788 wrote to memory of 1064 788 regsvr32.exe 36 PID 788 wrote to memory of 1064 788 regsvr32.exe 36 PID 788 wrote to memory of 1064 788 regsvr32.exe 36 PID 788 wrote to memory of 1064 788 regsvr32.exe 36 PID 788 wrote to memory of 1064 788 regsvr32.exe 36 PID 788 wrote to memory of 1064 788 regsvr32.exe 36 PID 1064 wrote to memory of 1600 1064 regsvr32.exe 37 PID 1064 wrote to memory of 1600 1064 regsvr32.exe 37 PID 1064 wrote to memory of 1600 1064 regsvr32.exe 37 PID 1064 wrote to memory of 1600 1064 regsvr32.exe 37 PID 1064 wrote to memory of 1600 1064 regsvr32.exe 37 PID 1196 wrote to memory of 320 1196 EXCEL.EXE 38 PID 1196 wrote to memory of 320 1196 EXCEL.EXE 38 PID 1196 wrote to memory of 320 1196 EXCEL.EXE 38 PID 1196 wrote to memory of 320 1196 EXCEL.EXE 38 PID 1196 wrote to memory of 320 1196 EXCEL.EXE 38 PID 1196 wrote to memory of 320 1196 EXCEL.EXE 38 PID 1196 wrote to memory of 320 1196 EXCEL.EXE 38
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\0311.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv1.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NoALMWnHms\GSHdRsrdoF.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv2.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\BCucYCLLNibP\dBZapqAmFVgenih.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1972
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv3.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\OOCEPJDQOHuHcXNra\TfxoLhd.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
PID:320 -
C:\Windows\system32\regsvr32.exe/S ..\oxnv4.ooccxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:632 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\CKrhV\RiVKC.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
712KB
MD5e9c78876397054610470ed1765e513fc
SHA1b17bbac23f937dc8740a00e9772480ac20d8f848
SHA256883c63303225d575a79e093bdc54d5422b5d004660e08328e3a4aaa617568c88
SHA512a42279f18582a15505a91e4c98e60bcfbcc79bf6a2c6b0420007bd679ecaf17c25df9ef613c86059898092fb8801199e5b7ce14e24d4153c7c724530d15d3deb
-
Filesize
712KB
MD57824389a5550185eae302c62185f84f2
SHA1a72c49cd1ee2f6e734645ce0f0e48b99f5057000
SHA2568ecb91df2203254bec36f2e723c8b3c6e408cbf8c7ec5b15f80fdee9bbdf1c99
SHA5122b56bf216e1b5289443e3e78b6379ef326dd97914a2a03d0a54bd05f4e344e8fc29e53f297630fb63aedae38512d53331bcd858da81e5560f24c0622d9a1362b
-
Filesize
712KB
MD5448791dc8b714131e79dec8f2fc822a0
SHA1efdac361bb0cf5d611fa0efc795ed63990c4bdb4
SHA2562934be24d457047141813d2650d6e1393a9d41b49e8f0c20c49d1ff0bb8258a5
SHA512803a0a118c30460474b7f8ed9f08fe6bfe748def8871dcff9d4f851eae025cd0f3bad843eb974cb00cae3a29a1d7df8e779b07f1d5f5dcffc45e03d23ffb4b8b
-
Filesize
712KB
MD5b98359148f2ad72b9875a41c4f792a2c
SHA1b11e7873a6624c562322eb41db23d6059da28ebe
SHA2565f330f1ca58e23d1849036bc1bbc398ea3d7277055b0d2e431174105eaf9eae1
SHA512b72c8ff4f8ac4312a0908671961075c324c72b230ff660350fac3aaf61ad334e075790c84bb8004ef7ae9652daccfacaa274d77483cf8ace4d134bd1823d2c70
-
Filesize
712KB
MD5e9c78876397054610470ed1765e513fc
SHA1b17bbac23f937dc8740a00e9772480ac20d8f848
SHA256883c63303225d575a79e093bdc54d5422b5d004660e08328e3a4aaa617568c88
SHA512a42279f18582a15505a91e4c98e60bcfbcc79bf6a2c6b0420007bd679ecaf17c25df9ef613c86059898092fb8801199e5b7ce14e24d4153c7c724530d15d3deb
-
Filesize
712KB
MD5e9c78876397054610470ed1765e513fc
SHA1b17bbac23f937dc8740a00e9772480ac20d8f848
SHA256883c63303225d575a79e093bdc54d5422b5d004660e08328e3a4aaa617568c88
SHA512a42279f18582a15505a91e4c98e60bcfbcc79bf6a2c6b0420007bd679ecaf17c25df9ef613c86059898092fb8801199e5b7ce14e24d4153c7c724530d15d3deb
-
Filesize
712KB
MD57824389a5550185eae302c62185f84f2
SHA1a72c49cd1ee2f6e734645ce0f0e48b99f5057000
SHA2568ecb91df2203254bec36f2e723c8b3c6e408cbf8c7ec5b15f80fdee9bbdf1c99
SHA5122b56bf216e1b5289443e3e78b6379ef326dd97914a2a03d0a54bd05f4e344e8fc29e53f297630fb63aedae38512d53331bcd858da81e5560f24c0622d9a1362b
-
Filesize
712KB
MD57824389a5550185eae302c62185f84f2
SHA1a72c49cd1ee2f6e734645ce0f0e48b99f5057000
SHA2568ecb91df2203254bec36f2e723c8b3c6e408cbf8c7ec5b15f80fdee9bbdf1c99
SHA5122b56bf216e1b5289443e3e78b6379ef326dd97914a2a03d0a54bd05f4e344e8fc29e53f297630fb63aedae38512d53331bcd858da81e5560f24c0622d9a1362b
-
Filesize
712KB
MD5448791dc8b714131e79dec8f2fc822a0
SHA1efdac361bb0cf5d611fa0efc795ed63990c4bdb4
SHA2562934be24d457047141813d2650d6e1393a9d41b49e8f0c20c49d1ff0bb8258a5
SHA512803a0a118c30460474b7f8ed9f08fe6bfe748def8871dcff9d4f851eae025cd0f3bad843eb974cb00cae3a29a1d7df8e779b07f1d5f5dcffc45e03d23ffb4b8b
-
Filesize
712KB
MD5448791dc8b714131e79dec8f2fc822a0
SHA1efdac361bb0cf5d611fa0efc795ed63990c4bdb4
SHA2562934be24d457047141813d2650d6e1393a9d41b49e8f0c20c49d1ff0bb8258a5
SHA512803a0a118c30460474b7f8ed9f08fe6bfe748def8871dcff9d4f851eae025cd0f3bad843eb974cb00cae3a29a1d7df8e779b07f1d5f5dcffc45e03d23ffb4b8b
-
Filesize
712KB
MD5b98359148f2ad72b9875a41c4f792a2c
SHA1b11e7873a6624c562322eb41db23d6059da28ebe
SHA2565f330f1ca58e23d1849036bc1bbc398ea3d7277055b0d2e431174105eaf9eae1
SHA512b72c8ff4f8ac4312a0908671961075c324c72b230ff660350fac3aaf61ad334e075790c84bb8004ef7ae9652daccfacaa274d77483cf8ace4d134bd1823d2c70
-
Filesize
712KB
MD5b98359148f2ad72b9875a41c4f792a2c
SHA1b11e7873a6624c562322eb41db23d6059da28ebe
SHA2565f330f1ca58e23d1849036bc1bbc398ea3d7277055b0d2e431174105eaf9eae1
SHA512b72c8ff4f8ac4312a0908671961075c324c72b230ff660350fac3aaf61ad334e075790c84bb8004ef7ae9652daccfacaa274d77483cf8ace4d134bd1823d2c70