Analysis
-
max time kernel
167s -
max time network
221s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 11:18
Behavioral task
behavioral1
Sample
4c5012e09502fe970287af43437a911ea116959eb1cc345428c29c2460c66f94.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4c5012e09502fe970287af43437a911ea116959eb1cc345428c29c2460c66f94.xls
Resource
win10v2004-20221111-en
General
-
Target
4c5012e09502fe970287af43437a911ea116959eb1cc345428c29c2460c66f94.xls
-
Size
117KB
-
MD5
24e671ce84223a3906fcc0929acc9661
-
SHA1
2f9b2a679333367cc2a71c07eee9086848167bb1
-
SHA256
4c5012e09502fe970287af43437a911ea116959eb1cc345428c29c2460c66f94
-
SHA512
bb5db75c0b3f2c7342e9e349c71964aaa7e4bb119501a80b007661ac9d03bd33c053709e9f61ba575582f0f7910bbec074b260a216f9769a941d1769c7474194
-
SSDEEP
3072:bZl6Nc7yRzs1H75wkZUgsQ6NqTBun5o8RDDVWVbrzQCITk9Ej4X1qiQi5:9l6Nc7yRzs1H75wkZUgsQ6NqTBun5oYw
Malware Config
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.execmd.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4392 4668 cmd.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1784 4668 cmd.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 5080 4668 cmd.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
NTFS ADS 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File created C:\Users\Admin\AppData\Local\Temp\B9495E00\:Zone.Identifier:$DATA EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4668 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE 4668 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEcmd.exedescription pid process target process PID 4668 wrote to memory of 4392 4668 EXCEL.EXE cmd.exe PID 4668 wrote to memory of 4392 4668 EXCEL.EXE cmd.exe PID 4668 wrote to memory of 1784 4668 EXCEL.EXE cmd.exe PID 4668 wrote to memory of 1784 4668 EXCEL.EXE cmd.exe PID 4668 wrote to memory of 5080 4668 EXCEL.EXE cmd.exe PID 4668 wrote to memory of 5080 4668 EXCEL.EXE cmd.exe PID 4392 wrote to memory of 1560 4392 cmd.exe attrib.exe PID 4392 wrote to memory of 1560 4392 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4c5012e09502fe970287af43437a911ea116959eb1cc345428c29c2460c66f94.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\system32\attrib.exeattrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"3⤵
- Views/modifies file attributes
PID:1560 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
PID:1784 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
PID:5080
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\78d1adc87d984f8c8511b20fcf1c98be /t 964 /p 46681⤵PID:1456
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1560-142-0x0000000000000000-mapping.dmp
-
memory/1784-140-0x0000000000000000-mapping.dmp
-
memory/4392-139-0x0000000000000000-mapping.dmp
-
memory/4668-138-0x00007FFA3ECC0000-0x00007FFA3ECD0000-memory.dmpFilesize
64KB
-
memory/4668-136-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/4668-137-0x00007FFA3ECC0000-0x00007FFA3ECD0000-memory.dmpFilesize
64KB
-
memory/4668-132-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/4668-135-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/4668-134-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/4668-133-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/4668-144-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/4668-146-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/4668-145-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/4668-147-0x00007FFA41590000-0x00007FFA415A0000-memory.dmpFilesize
64KB
-
memory/5080-141-0x0000000000000000-mapping.dmp