Analysis
-
max time kernel
153s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 11:41
Behavioral task
behavioral1
Sample
64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3.xls
Resource
win10v2004-20220901-en
General
-
Target
64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3.xls
-
Size
107KB
-
MD5
10a55477cca9dd8c9a3b1c45790d1374
-
SHA1
9b5a9de959281c78c986cb77398ca8fe7acfb546
-
SHA256
64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3
-
SHA512
2b335c996c157954203f7b5f0b62e03f0ef4afd8732e18ea7960533a9074faf028f93877da20bfbe27ee2f6dd022ed020c4a2eb78fcfdf46f4a565433a387d66
-
SSDEEP
1536:YlllJMlDN1HZ/PERhwYZrrMs7Gu/XoHGkPrMsl/COR/vVf3Gwmsij9wDjppVMhua:DvVfmSWcwH7wDbT2J
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2028 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
EXCEL.EXEpid process 2028 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2028 wrote to memory of 520 2028 EXCEL.EXE splwow64.exe PID 2028 wrote to memory of 520 2028 EXCEL.EXE splwow64.exe PID 2028 wrote to memory of 520 2028 EXCEL.EXE splwow64.exe PID 2028 wrote to memory of 520 2028 EXCEL.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/520-59-0x0000000000000000-mapping.dmp
-
memory/520-60-0x000007FEFB881000-0x000007FEFB883000-memory.dmpFilesize
8KB
-
memory/2028-54-0x000000002FA31000-0x000000002FA34000-memory.dmpFilesize
12KB
-
memory/2028-55-0x00000000710E1000-0x00000000710E3000-memory.dmpFilesize
8KB
-
memory/2028-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2028-57-0x00000000753F1000-0x00000000753F3000-memory.dmpFilesize
8KB
-
memory/2028-58-0x00000000720CD000-0x00000000720D8000-memory.dmpFilesize
44KB
-
memory/2028-61-0x000000006C801000-0x000000006C803000-memory.dmpFilesize
8KB