Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
09/11/2022, 21:29
Behavioral task
behavioral1
Sample
7888.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7888.xls
Resource
win10v2004-20220901-en
General
-
Target
7888.xls
-
Size
91KB
-
MD5
dc8030748a00443a85ae4746c87f36dd
-
SHA1
5bb6cc85bff4d6a13b28b9475cb591e9acaefa1a
-
SHA256
ba511dcd0bab4020d5b041377a136718208a965c7e5ffd4313c90b2910dbde0c
-
SHA512
0cba16412ef7cf52d8075b025ed78a449256758adc143edffe2422c7513f2218fcf6fa3e8ede6ae32bf99ffeaab9627aa726d9cd73e264237590a5c57b747f94
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgMbCXuZH4gb4CEn9J4ZCX3O:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgW
Malware Config
Extracted
https://encuadernacionesartis.com/Vk2Z1Na/IZpyySkbU/
http://eznetb.synology.me/@eaDir/E36Y/
http://bytesendesign.nl/cgi-bin/LolX/
http://choltice.eu/mwc/syl3Y/
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 364 1708 regsvr32.exe 25 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1536 1708 regsvr32.exe 25 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2008 1708 regsvr32.exe 25 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 816 1708 regsvr32.exe 25 -
Downloads MZ/PE file
-
Loads dropped DLL 6 IoCs
pid Process 1536 regsvr32.exe 1240 regsvr32.exe 2008 regsvr32.exe 1784 regsvr32.exe 816 regsvr32.exe 1524 regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1708 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1240 regsvr32.exe 1620 regsvr32.exe 1620 regsvr32.exe 1784 regsvr32.exe 568 regsvr32.exe 568 regsvr32.exe 1524 regsvr32.exe 1724 regsvr32.exe 1724 regsvr32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1708 EXCEL.EXE 1708 EXCEL.EXE 1708 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 364 1708 EXCEL.EXE 28 PID 1708 wrote to memory of 364 1708 EXCEL.EXE 28 PID 1708 wrote to memory of 364 1708 EXCEL.EXE 28 PID 1708 wrote to memory of 364 1708 EXCEL.EXE 28 PID 1708 wrote to memory of 364 1708 EXCEL.EXE 28 PID 1708 wrote to memory of 364 1708 EXCEL.EXE 28 PID 1708 wrote to memory of 364 1708 EXCEL.EXE 28 PID 1708 wrote to memory of 1536 1708 EXCEL.EXE 29 PID 1708 wrote to memory of 1536 1708 EXCEL.EXE 29 PID 1708 wrote to memory of 1536 1708 EXCEL.EXE 29 PID 1708 wrote to memory of 1536 1708 EXCEL.EXE 29 PID 1708 wrote to memory of 1536 1708 EXCEL.EXE 29 PID 1708 wrote to memory of 1536 1708 EXCEL.EXE 29 PID 1708 wrote to memory of 1536 1708 EXCEL.EXE 29 PID 1536 wrote to memory of 1240 1536 regsvr32.exe 30 PID 1536 wrote to memory of 1240 1536 regsvr32.exe 30 PID 1536 wrote to memory of 1240 1536 regsvr32.exe 30 PID 1536 wrote to memory of 1240 1536 regsvr32.exe 30 PID 1536 wrote to memory of 1240 1536 regsvr32.exe 30 PID 1536 wrote to memory of 1240 1536 regsvr32.exe 30 PID 1536 wrote to memory of 1240 1536 regsvr32.exe 30 PID 1240 wrote to memory of 1620 1240 regsvr32.exe 31 PID 1240 wrote to memory of 1620 1240 regsvr32.exe 31 PID 1240 wrote to memory of 1620 1240 regsvr32.exe 31 PID 1240 wrote to memory of 1620 1240 regsvr32.exe 31 PID 1240 wrote to memory of 1620 1240 regsvr32.exe 31 PID 1708 wrote to memory of 2008 1708 EXCEL.EXE 32 PID 1708 wrote to memory of 2008 1708 EXCEL.EXE 32 PID 1708 wrote to memory of 2008 1708 EXCEL.EXE 32 PID 1708 wrote to memory of 2008 1708 EXCEL.EXE 32 PID 1708 wrote to memory of 2008 1708 EXCEL.EXE 32 PID 1708 wrote to memory of 2008 1708 EXCEL.EXE 32 PID 1708 wrote to memory of 2008 1708 EXCEL.EXE 32 PID 2008 wrote to memory of 1784 2008 regsvr32.exe 33 PID 2008 wrote to memory of 1784 2008 regsvr32.exe 33 PID 2008 wrote to memory of 1784 2008 regsvr32.exe 33 PID 2008 wrote to memory of 1784 2008 regsvr32.exe 33 PID 2008 wrote to memory of 1784 2008 regsvr32.exe 33 PID 2008 wrote to memory of 1784 2008 regsvr32.exe 33 PID 2008 wrote to memory of 1784 2008 regsvr32.exe 33 PID 1784 wrote to memory of 568 1784 regsvr32.exe 34 PID 1784 wrote to memory of 568 1784 regsvr32.exe 34 PID 1784 wrote to memory of 568 1784 regsvr32.exe 34 PID 1784 wrote to memory of 568 1784 regsvr32.exe 34 PID 1784 wrote to memory of 568 1784 regsvr32.exe 34 PID 1708 wrote to memory of 816 1708 EXCEL.EXE 35 PID 1708 wrote to memory of 816 1708 EXCEL.EXE 35 PID 1708 wrote to memory of 816 1708 EXCEL.EXE 35 PID 1708 wrote to memory of 816 1708 EXCEL.EXE 35 PID 1708 wrote to memory of 816 1708 EXCEL.EXE 35 PID 1708 wrote to memory of 816 1708 EXCEL.EXE 35 PID 1708 wrote to memory of 816 1708 EXCEL.EXE 35 PID 816 wrote to memory of 1524 816 regsvr32.exe 36 PID 816 wrote to memory of 1524 816 regsvr32.exe 36 PID 816 wrote to memory of 1524 816 regsvr32.exe 36 PID 816 wrote to memory of 1524 816 regsvr32.exe 36 PID 816 wrote to memory of 1524 816 regsvr32.exe 36 PID 816 wrote to memory of 1524 816 regsvr32.exe 36 PID 816 wrote to memory of 1524 816 regsvr32.exe 36 PID 1524 wrote to memory of 1724 1524 regsvr32.exe 37 PID 1524 wrote to memory of 1724 1524 regsvr32.exe 37 PID 1524 wrote to memory of 1724 1524 regsvr32.exe 37 PID 1524 wrote to memory of 1724 1524 regsvr32.exe 37 PID 1524 wrote to memory of 1724 1524 regsvr32.exe 37
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\7888.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx2⤵
- Process spawned unexpected child process
PID:364
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\regsvr32.exe/S ..\elv2.ooocccxxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\MlykQqCp\qaOuV.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\regsvr32.exe/S ..\elv3.ooocccxxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZaYvYtcLFWXIhRvJ\SVMWcXyscVEnYvyD.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:568
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\system32\regsvr32.exe/S ..\elv4.ooocccxxx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\WxvKiCfcunZq\nuoAm.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
591KB
MD5fc42d4274889d24061da931439218815
SHA187825a784269b0829af7285ecd1a50a4642f77b4
SHA256942125f9a34fdedbbaf65e98e25ad82b819d69418ae79fcd6bcbc00393436538
SHA512ac8e03ae85bb2a4d407f4394835e124b8b3beb415197b4660bf52f8594e988279819ee5580e9a88eb564358b4fc37d83145e9cbfff90e783b6147eeeaeb68b5d
-
Filesize
591KB
MD54c606ed4fcf79b57fe150dd6f079e484
SHA1eca371209d3f1144d0e6b829a8054ec275789128
SHA2565c55df77060b90ea6063a21ae0cf631c9a2bc0a80511042a358c691e338b22e3
SHA5125a6c9c090f5e9f63efa4dd4a26ee6c9d1feeedde024cb7ae8429c99f6c18d78acfb1b30f77fc1677d09bd385116a36d3f7ad66863d92efc4397b72f299900bbd
-
Filesize
591KB
MD565f2a034695fa56099c6f4ef61f41970
SHA121ff15d869810727177a036f23c58f99a67f0c61
SHA256de9286b0404b08dc867b514cced98af9c20c01f4123305e9388c783f00a49969
SHA5124942c7cd563d55ae56ad3904e39b19e0dbf17019d281c5cd97e3763a45d1dada26a6e9ffbf6bf46a6fb53a5f137f514c82d7f22865ef3d1e84bcdcd3fd1f94cb
-
Filesize
591KB
MD5fc42d4274889d24061da931439218815
SHA187825a784269b0829af7285ecd1a50a4642f77b4
SHA256942125f9a34fdedbbaf65e98e25ad82b819d69418ae79fcd6bcbc00393436538
SHA512ac8e03ae85bb2a4d407f4394835e124b8b3beb415197b4660bf52f8594e988279819ee5580e9a88eb564358b4fc37d83145e9cbfff90e783b6147eeeaeb68b5d
-
Filesize
591KB
MD5fc42d4274889d24061da931439218815
SHA187825a784269b0829af7285ecd1a50a4642f77b4
SHA256942125f9a34fdedbbaf65e98e25ad82b819d69418ae79fcd6bcbc00393436538
SHA512ac8e03ae85bb2a4d407f4394835e124b8b3beb415197b4660bf52f8594e988279819ee5580e9a88eb564358b4fc37d83145e9cbfff90e783b6147eeeaeb68b5d
-
Filesize
591KB
MD54c606ed4fcf79b57fe150dd6f079e484
SHA1eca371209d3f1144d0e6b829a8054ec275789128
SHA2565c55df77060b90ea6063a21ae0cf631c9a2bc0a80511042a358c691e338b22e3
SHA5125a6c9c090f5e9f63efa4dd4a26ee6c9d1feeedde024cb7ae8429c99f6c18d78acfb1b30f77fc1677d09bd385116a36d3f7ad66863d92efc4397b72f299900bbd
-
Filesize
591KB
MD54c606ed4fcf79b57fe150dd6f079e484
SHA1eca371209d3f1144d0e6b829a8054ec275789128
SHA2565c55df77060b90ea6063a21ae0cf631c9a2bc0a80511042a358c691e338b22e3
SHA5125a6c9c090f5e9f63efa4dd4a26ee6c9d1feeedde024cb7ae8429c99f6c18d78acfb1b30f77fc1677d09bd385116a36d3f7ad66863d92efc4397b72f299900bbd
-
Filesize
591KB
MD565f2a034695fa56099c6f4ef61f41970
SHA121ff15d869810727177a036f23c58f99a67f0c61
SHA256de9286b0404b08dc867b514cced98af9c20c01f4123305e9388c783f00a49969
SHA5124942c7cd563d55ae56ad3904e39b19e0dbf17019d281c5cd97e3763a45d1dada26a6e9ffbf6bf46a6fb53a5f137f514c82d7f22865ef3d1e84bcdcd3fd1f94cb
-
Filesize
591KB
MD565f2a034695fa56099c6f4ef61f41970
SHA121ff15d869810727177a036f23c58f99a67f0c61
SHA256de9286b0404b08dc867b514cced98af9c20c01f4123305e9388c783f00a49969
SHA5124942c7cd563d55ae56ad3904e39b19e0dbf17019d281c5cd97e3763a45d1dada26a6e9ffbf6bf46a6fb53a5f137f514c82d7f22865ef3d1e84bcdcd3fd1f94cb