0d2d6881a1217e2d4fac370e22db7cc094d3a95c46b74957541ae8fcd20e3fea

General

Target

0d2d6881a1217e2d4fac370e22db7cc094d3a95c46b74957541ae8fcd20e3fea.xls
Size

308KB
MD5

42a76635b4ce4e7bf708a738ab24ed6a
SHA1

3add63d07d71fa58aec69ddfb74f61e8a0556999
SHA256

0d2d6881a1217e2d4fac370e22db7cc094d3a95c46b74957541ae8fcd20e3fea
SHA512

1b7dcef7644e68ca5352090efab7cf5467a1f590e34993d2a4d5f9bec8ca367772de932e2341ad34cf9610402d0e089c41c178000bd47b753a234e03849566e0
SSDEEP

6144:2l6Nc7yRzs1H75wkZUgsQ6NqTBun5oOFRynDDaU05XQ/zuqsfqHh7dClDwXP+ZrZ:FynDdJzkf0CSXPQo1Nf

Score

10^/10

evasion macro macro_on_action persistence xlm

Malware Config

Signatures

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	776	2008	cmd.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1752	2008	cmd.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1388	2008	cmd.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	924	2008	cmd.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1796	2008	cmd.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1308	2008	cmd.exe	EXCEL.EXE

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
\??\c:\norma1.xlm	office_macro_on_action

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1364 attrib.exe
1008 attrib.exe

pid	process
1364	attrib.exe
1008	attrib.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

Processes:

resource	yara_rule
\??\c:\norma1.xlm	office_xlm_macros

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet.exe = "internet.exe"	EXCEL.EXE

Drops file in System32 directory 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\Windows\SysWOW64\internet.exe EXCEL.EXE
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
File created	C:\Windows\SysWOW64\internet.exe	EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXEWINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2008 EXCEL.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

EXCEL.EXE

pid process

2008 EXCEL.EXE
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

EXCEL.EXEWINWORD.EXE

pid process

2008 EXCEL.EXE
2008 EXCEL.EXE
2008 EXCEL.EXE
2008 EXCEL.EXE
2008 EXCEL.EXE
1336 WINWORD.EXE
1336 WINWORD.EXE
2008 EXCEL.EXE
2008 EXCEL.EXE

pid	process
2008	EXCEL.EXE

pid	process
2008	EXCEL.EXE

pid	process
2008	EXCEL.EXE
2008	EXCEL.EXE
2008	EXCEL.EXE
2008	EXCEL.EXE
2008	EXCEL.EXE
1336	WINWORD.EXE
1336	WINWORD.EXE
2008	EXCEL.EXE
2008	EXCEL.EXE

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

EXCEL.EXEcmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 776	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 776	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 776	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 776	2008	EXCEL.EXE	cmd.exe
PID 776 wrote to memory of 1780	776	cmd.exe	attrib.exe
PID 776 wrote to memory of 1780	776	cmd.exe	attrib.exe
PID 776 wrote to memory of 1780	776	cmd.exe	attrib.exe
PID 776 wrote to memory of 1780	776	cmd.exe	attrib.exe
PID 2008 wrote to memory of 1752	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1752	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1752	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1752	2008	EXCEL.EXE	cmd.exe
PID 1752 wrote to memory of 540	1752	cmd.exe	attrib.exe
PID 1752 wrote to memory of 540	1752	cmd.exe	attrib.exe
PID 1752 wrote to memory of 540	1752	cmd.exe	attrib.exe
PID 1752 wrote to memory of 540	1752	cmd.exe	attrib.exe
PID 2008 wrote to memory of 1388	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1388	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1388	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1388	2008	EXCEL.EXE	cmd.exe
PID 1388 wrote to memory of 1328	1388	cmd.exe	extrac32.exe
PID 1388 wrote to memory of 1328	1388	cmd.exe	extrac32.exe
PID 1388 wrote to memory of 1328	1388	cmd.exe	extrac32.exe
PID 1388 wrote to memory of 1328	1388	cmd.exe	extrac32.exe
PID 2008 wrote to memory of 924	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 924	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 924	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 924	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1796	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1796	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1796	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1796	2008	EXCEL.EXE	cmd.exe
PID 1796 wrote to memory of 1364	1796	cmd.exe	attrib.exe
PID 1796 wrote to memory of 1364	1796	cmd.exe	attrib.exe
PID 1796 wrote to memory of 1364	1796	cmd.exe	attrib.exe
PID 1796 wrote to memory of 1364	1796	cmd.exe	attrib.exe
PID 2008 wrote to memory of 1308	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1308	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1308	2008	EXCEL.EXE	cmd.exe
PID 2008 wrote to memory of 1308	2008	EXCEL.EXE	cmd.exe
PID 1308 wrote to memory of 1008	1308	cmd.exe	attrib.exe
PID 1308 wrote to memory of 1008	1308	cmd.exe	attrib.exe
PID 1308 wrote to memory of 1008	1308	cmd.exe	attrib.exe
PID 1308 wrote to memory of 1008	1308	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 4 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

1780 attrib.exe
540 attrib.exe
1364 attrib.exe
1008 attrib.exe

pid	process
1780	attrib.exe
540	attrib.exe
1364	attrib.exe
1008	attrib.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\0d2d6881a1217e2d4fac370e22db7cc094d3a95c46b74957541ae8fcd20e3fea.xls
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c attrib -s -h c:\setflag.exe
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\attrib.exe
attrib -s -h c:\setflag.exe
3⤵
- Views/modifies file attributes
PID:1780

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c attrib -s -h c:\sendto.exe
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\attrib.exe
attrib -s -h c:\sendto.exe
3⤵
- Views/modifies file attributes
PID:540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c extrac32 /E /Y /L c:\ c:\cab.cab
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\extrac32.exe
extrac32 /E /Y /L c:\ c:\cab.cab
3⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c extract /E /Y /L c:\ c:\cab.cab
2⤵
- Process spawned unexpected child process
PID:924

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c attrib +s +h c:\setflag.exe
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\attrib.exe
attrib +s +h c:\setflag.exe
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1364

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c attrib +s +h c:\sendto.exe
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\attrib.exe
attrib +s +h c:\sendto.exe
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1008

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1336

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\sendto.exe
Filesize
20KB

MD5
56bafcef305ce46d847421edd6eec04b

SHA1
e6e31dda260fee10b63c4dd297b433749ea7ac07

SHA256
3c6d90fdf13ef66dd36631796cd50db01dfb8e2db5b472c45202513ab816f272

SHA512
c78210f40daa6e2827d1280eaca5ae22cf036d20ff802826171cfdaf2b64a011f32c8689eec174d3375e197b240e4c92a2fb466b01c66a96e9276cd1de160e20

Download Submit
C:\setflag.exe
Filesize
32KB

MD5
a4f9be8517afb4c5d9c63960a5faf258

SHA1
6d3300bfc43b191819f687df91bfbe2c6294d6bb

SHA256
78b6db289832df709d17fd5c49359ddfb9cacaa8303cd77290427bac4c829ba2

SHA512
c6c918bc91ed645553245cc640ed66882af264035732b8a8c2682f14a9c8f183c38837c1b3e62ca7d16e1560e6bc2a4273b41c9614a046752928c9a0c45ecb2e

Download Submit
\??\c:\cab.cab
Filesize
70KB

MD5
5a876443f36ca54efae1c723041435c0

SHA1
7ebd6188c3df725008209b7d24f914b2b3ce0a6c

SHA256
02397a86f99f98f212adee047d25c56fa6644a3cf6058ddb0da0221d708f1ee9

SHA512
a065a1ed747b8348c49c909e7186da584a3f01bca4652b154d5f7f88c4de15c5f0c03884db5cf33bca9035944cf5c7bc6983571301dd0fa4d7c298942887a149

Download Submit
\??\c:\internet.exe
Filesize
24KB

MD5
072ca9f791665febeacda1be1e71a124

SHA1
20d6d75ef7e06c72b43a2e3be81f5ceab11a1a5a

SHA256
692bfa3ca595a0ed57dd1d5fa6652332162c90ea0c9b8c9b32ddbebbec063f3d

SHA512
3cd1c0727085dcc054b1c9111c934fef3473d57a91e1e247418a220e35c59e495282740621d6c9c01c86a39ad4e5c79d7d95dbd289e25f044cfad1f616d52290

Download Submit
\??\c:\norma1.xlm
Filesize
68KB

MD5
3f08a7010fe4ea32b210b7919448ada6

SHA1
c7bc3bb8f78ef217b83c593542b5c4cf602746a2

SHA256
506260a97f723ce79e3243b651dc8af1c3fcdbf72431be60b1a0afbab8d2dce9

SHA512
be8ac3dcb6574e6876c2f8d2e40c1c6ad75ca611275ccc73c7283f6b17f3956c16c14d9dfa10e36576011baa691378a8ce6115e380b821a2d6f549ea46567b4c

Download Submit
\??\c:\normal.dot
Filesize
103KB

MD5
26ab77fe4d542805e0afdc9d0efc92c2

SHA1
332dc776b13e8f04809a312183ef9532ea2b18d3

SHA256
1cb2d969e56664ddc1f496c63e424cbe1ce2f560f8350f4ffa451f0fc03006d9

SHA512
ef439dbbe390eb175bd9970d76827a6b506b88a4db7cda233d8b6591b22e3c7a454cbb8111ca78dbbd6b195c91aa89c7d0c9df952052d3471eb07ac80f98b89a

Download Submit
memory/540-64-0x0000000000000000-mapping.dmp

Download
memory/776-61-0x0000000000000000-mapping.dmp

Download
memory/924-68-0x0000000000000000-mapping.dmp

Download
memory/1008-80-0x0000000000000000-mapping.dmp

Download
memory/1308-79-0x0000000000000000-mapping.dmp

Download
memory/1328-66-0x0000000000000000-mapping.dmp

Download
memory/1336-84-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1336-82-0x0000000071DCD000-0x0000000071DD8000-memory.dmp

Filesize
44KB

Download
memory/1336-70-0x000000006AD31000-0x000000006AD34000-memory.dmp

Filesize
12KB

Download
memory/1364-77-0x0000000000000000-mapping.dmp

Download
memory/1388-65-0x0000000000000000-mapping.dmp

Download
memory/1752-63-0x0000000000000000-mapping.dmp

Download
memory/1780-62-0x0000000000000000-mapping.dmp

Download
memory/1796-76-0x0000000000000000-mapping.dmp

Download
memory/2008-60-0x0000000000584000-0x0000000000588000-memory.dmp

Filesize
16KB

Download
memory/2008-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2008-57-0x0000000071DCD000-0x0000000071DD8000-memory.dmp

Filesize
44KB

Download
memory/2008-58-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000070DE1000-0x0000000070DE3000-memory.dmp

Filesize
8KB

Download
memory/2008-59-0x0000000000584000-0x0000000000588000-memory.dmp

Filesize
16KB

Download
memory/2008-83-0x0000000071DCD000-0x0000000071DD8000-memory.dmp

Filesize
44KB

Download
memory/2008-54-0x000000002F021000-0x000000002F024000-memory.dmp

Filesize
12KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads