90b623f8dd25546f0787a0f798727c4370ef7e11f65c6f9ae1e7c4a7ac1fddac

Analysis

max time kernel
151s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90b623f8dd25546f0787a0f798727c4370ef7e11f65c6f9ae1e7c4a7ac1fddac.xls
Size

61KB
MD5

1f098e3972fe839a3362e28b487ddc20
SHA1

b2cb49020ea9a1d4cb70c953ac921b9db1a1bf87
SHA256

90b623f8dd25546f0787a0f798727c4370ef7e11f65c6f9ae1e7c4a7ac1fddac
SHA512

fb19b3fa691aaf5b5af1cead86eed275e5a2e6b326111cb1f255d0c3685c4375353a74cab63c4ec34a48964704334643b27e7b43be44d8656c483bff8f3469ce
SSDEEP

1536:gMMMMguR/VBSbX/uZnN49GH6lFMu2foB9QFaURJlhFhlGGIOr1cEwWsoa3HnfkJb:hQFhrlGG3r1cMsT3HnfkJGS4GvrqkKmn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1632 EXCEL.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

EXCEL.EXE

pid process

1632 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1632 EXCEL.EXE
1632 EXCEL.EXE
1632 EXCEL.EXE

pid	process
1632	EXCEL.EXE

pid	process
1632	EXCEL.EXE

pid	process
1632	EXCEL.EXE
1632	EXCEL.EXE
1632	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\90b623f8dd25546f0787a0f798727c4370ef7e11f65c6f9ae1e7c4a7ac1fddac.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1632

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-54-0x000000002F671000-0x000000002F674000-memory.dmp

Filesize
12KB

Download
memory/1632-55-0x0000000070DC1000-0x0000000070DC3000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1632-57-0x0000000071DAD000-0x0000000071DB8000-memory.dmp

Filesize
44KB

Download
memory/1632-58-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1632-59-0x000000006C601000-0x000000006C603000-memory.dmp

Filesize
8KB

Download
memory/1632-60-0x0000000071DAD000-0x0000000071DB8000-memory.dmp

Filesize
44KB

Download