7cfcc3083dca81f5c651166e8b5edd7c8856b36408ddc957c64b7e78457b2b8f

Analysis

max time kernel
185s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cfcc3083dca81f5c651166e8b5edd7c8856b36408ddc957c64b7e78457b2b8f.xls
Size

544KB
MD5

1072b64bead4da7bab1176b47602af4a
SHA1

8018cd1fae20ba05c6852038e59675bcd1bcda56
SHA256

7cfcc3083dca81f5c651166e8b5edd7c8856b36408ddc957c64b7e78457b2b8f
SHA512

73938d99c9171f8d9a5aafb335945a19a785256f9b1f9e52dee4d3dc60f356d3bc656502a57f2080bc2378f8f6c5bad7bffd3af4245685ce9323e1295e767e2f
SSDEEP

6144:6ZmRlSGCefI+BE34YwB6U4RFvodDLMw+2GED07:omRlSzjUEI7g/oDLSeY

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3876	3780	cmd.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1084	3780	cmd.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1608	3780	cmd.exe	82

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3780	EXCEL.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE
3780	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3876	3780	EXCEL.EXE	93
PID 3780 wrote to memory of 3876	3780	EXCEL.EXE	93
PID 3780 wrote to memory of 1084	3780	EXCEL.EXE	94
PID 3780 wrote to memory of 1084	3780	EXCEL.EXE	94
PID 3780 wrote to memory of 1608	3780	EXCEL.EXE	96
PID 3780 wrote to memory of 1608	3780	EXCEL.EXE	96
PID 3876 wrote to memory of 2104	3876	cmd.exe	100
PID 3876 wrote to memory of 2104	3876	cmd.exe	100

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2104	attrib.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7cfcc3083dca81f5c651166e8b5edd7c8856b36408ddc957c64b7e78457b2b8f.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\system32\attrib.exe
    attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
    3⤵
    - Views/modifies file attributes
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  PID:1608

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\ceb4716f9402427484937a88273eb74e /t 2944 /p 3780
1⤵
PID:636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3780-132-0x00007FF9F9A30000-0x00007FF9F9A40000-memory.dmp

Filesize
64KB

Download
memory/3780-134-0x00007FF9F9A30000-0x00007FF9F9A40000-memory.dmp

Filesize
64KB

Download
memory/3780-133-0x00007FF9F9A30000-0x00007FF9F9A40000-memory.dmp

Filesize
64KB

Download
memory/3780-135-0x00007FF9F9A30000-0x00007FF9F9A40000-memory.dmp

Filesize
64KB

Download
memory/3780-136-0x00007FF9F9A30000-0x00007FF9F9A40000-memory.dmp

Filesize
64KB

Download
memory/3780-137-0x00007FF9F78D0000-0x00007FF9F78E0000-memory.dmp

Filesize
64KB

Download
memory/3780-138-0x00007FF9F78D0000-0x00007FF9F78E0000-memory.dmp

Filesize
64KB

Download
memory/3780-142-0x0000016B7E09D000-0x0000016B7E09F000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads