Analysis
-
max time kernel
179s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 03:10
Behavioral task
behavioral1
Sample
91d0e2db5186b1bbb572b959915706234f25e01ab065c97a23986341cb4d77bf.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
91d0e2db5186b1bbb572b959915706234f25e01ab065c97a23986341cb4d77bf.xls
Resource
win10v2004-20221111-en
General
-
Target
91d0e2db5186b1bbb572b959915706234f25e01ab065c97a23986341cb4d77bf.xls
-
Size
131KB
-
MD5
578ec83f00482a0eb6ef9ac7d335824a
-
SHA1
832f7ac4715fc88e203f2ef42d2e5511e2bf7bec
-
SHA256
91d0e2db5186b1bbb572b959915706234f25e01ab065c97a23986341cb4d77bf
-
SHA512
680480e8ae798fdf2bbc3a45a4bc30b858416d6440f01558ef7a261fe5ce073b0066d7f314e3d487a537cb61829f01965f7f95352d5e6af68f4f1e1548f51baf
-
SSDEEP
1536:wnnnjYiabhn9nhnrngvna3APUi5g0Ka0pNMWVbrzQSstITkbA23CozWWt2XKyISs:X30UX0Ka0pNMWVbrzQSstITkZ7yaPZ
Malware Config
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.execmd.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 796 5020 cmd.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4864 5020 cmd.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 800 5020 cmd.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 5020 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
EXCEL.EXEpid process 5020 EXCEL.EXE 5020 EXCEL.EXE 5020 EXCEL.EXE 5020 EXCEL.EXE 5020 EXCEL.EXE 5020 EXCEL.EXE 5020 EXCEL.EXE 5020 EXCEL.EXE 5020 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 5020 wrote to memory of 796 5020 EXCEL.EXE cmd.exe PID 5020 wrote to memory of 796 5020 EXCEL.EXE cmd.exe PID 5020 wrote to memory of 4864 5020 EXCEL.EXE cmd.exe PID 5020 wrote to memory of 4864 5020 EXCEL.EXE cmd.exe PID 5020 wrote to memory of 800 5020 EXCEL.EXE cmd.exe PID 5020 wrote to memory of 800 5020 EXCEL.EXE cmd.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\91d0e2db5186b1bbb572b959915706234f25e01ab065c97a23986341cb4d77bf.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\cc19ce52ec604ca6b71b2e6a64b03dd3 /t 2444 /p 50201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/796-139-0x0000000000000000-mapping.dmp
-
memory/800-141-0x0000000000000000-mapping.dmp
-
memory/4864-140-0x0000000000000000-mapping.dmp
-
memory/5020-132-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/5020-133-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/5020-134-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/5020-135-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/5020-136-0x00007FFD40710000-0x00007FFD40720000-memory.dmpFilesize
64KB
-
memory/5020-137-0x00007FFD3E6B0000-0x00007FFD3E6C0000-memory.dmpFilesize
64KB
-
memory/5020-138-0x00007FFD3E6B0000-0x00007FFD3E6C0000-memory.dmpFilesize
64KB