abf05a49ab888fcbe3984003176fe6e56c0f79eb82b3f501d161ba357f1c10db

Analysis

max time kernel
205s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Summary-1702295810-Jan31.xlsb
Size

129KB
MD5

ace572c463a4750dd386230a49d0813d
SHA1

e6a8f6591ca251d8dff34777da4b34aeff887f5f
SHA256

ff6d0d7393fce9ee3eb0ba57954f8fc3129dc7091d5c0a5405bc0ba9c2e158a0
SHA512

20590fa7e831c95b481976205df7d1af464bd66bc6443c62c63aad6238604abfa3ade5fae5ea90755b0d7c69b4513fe2a7fd39f268d54284b628feec31cc2bed
SSDEEP

3072:S+vHLEhWYjnsCbxKljNE5gKmFOi+uaE7O6Lk:rohtrsCbxKljDKmFOi/7Ob

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://94.140.112.209/5226172599393720.dat

xlm40.dropper

http://185.190.80.172/5226172599393720.dat

xlm40.dropper

http://111.90.150.43/%205226172599393720.dat

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1592	1508	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1380	1508	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3696	1508	regsvr32.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1508 EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE
1508	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 1508 wrote to memory of 1592	1508	EXCEL.EXE	regsvr32.exe
PID 1508 wrote to memory of 1592	1508	EXCEL.EXE	regsvr32.exe
PID 1508 wrote to memory of 1380	1508	EXCEL.EXE	regsvr32.exe
PID 1508 wrote to memory of 1380	1508	EXCEL.EXE	regsvr32.exe
PID 1508 wrote to memory of 3696	1508	EXCEL.EXE	regsvr32.exe
PID 1508 wrote to memory of 3696	1508	EXCEL.EXE	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Summary-1702295810-Jan31.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SYSTEM32\regsvr32.exe
regsvr32 C:\ProgramData\Ropedjo1.ocx
2⤵
- Process spawned unexpected child process
PID:1592

C:\Windows\SYSTEM32\regsvr32.exe
regsvr32 C:\ProgramData\Ropedjo2.ocx
2⤵
- Process spawned unexpected child process
PID:1380

C:\Windows\SYSTEM32\regsvr32.exe
regsvr32 C:\ProgramData\Ropedjo3.ocx
2⤵
- Process spawned unexpected child process
PID:3696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Ropedjo1.ocx
Filesize
18B

MD5
ff6241b6d94385c20c03a42091f3f13d

SHA1
b24305452439a3f01853f4e7319312cb9fb8013e

SHA256
05455b434aaee0ec7b3f37a2796f73cb09b3570ebacef9b96f3621d78d450b87

SHA512
075cb16cd64c89f790e676ded743845ff5d6e500e7c23339e113cd3fd7054e4f886d87a4bc18fd0183c9b91635ead75b0baa37ad69aa03ee097ed4bf103fb28a

Download Submit
memory/1380-141-0x0000000000000000-mapping.dmp

Download
memory/1508-132-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmp

Filesize
64KB

Download
memory/1508-133-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmp

Filesize
64KB

Download
memory/1508-134-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmp

Filesize
64KB

Download
memory/1508-135-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmp

Filesize
64KB

Download
memory/1508-136-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmp

Filesize
64KB

Download
memory/1508-137-0x00007FFFB4A70000-0x00007FFFB4A80000-memory.dmp

Filesize
64KB

Download
memory/1508-138-0x00007FFFB4A70000-0x00007FFFB4A80000-memory.dmp

Filesize
64KB

Download
memory/1592-139-0x0000000000000000-mapping.dmp

Download
memory/3696-142-0x0000000000000000-mapping.dmp

Download