Analysis
-
max time kernel
173s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 11:41
Behavioral task
behavioral1
Sample
66d9b8923b9a0eadbbce1ab82a98abca897fe501c1e2f9b3f9544699531c5aad.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
66d9b8923b9a0eadbbce1ab82a98abca897fe501c1e2f9b3f9544699531c5aad.xls
Resource
win10v2004-20221111-en
General
-
Target
66d9b8923b9a0eadbbce1ab82a98abca897fe501c1e2f9b3f9544699531c5aad.xls
-
Size
168KB
-
MD5
d01eaca985792a1b15548daf5b12696c
-
SHA1
1c42d5430ba49e183c354937c3361dd32d6fcc2e
-
SHA256
66d9b8923b9a0eadbbce1ab82a98abca897fe501c1e2f9b3f9544699531c5aad
-
SHA512
bc06cb9da277123b267a2b052e3388d944437011c25df802a652d8808cd76484b05adce4d0ed6476687adafcc8c9f246451f6f28ad3931ec47da37f9816b0259
-
SSDEEP
1536:hHHHDsHJNP/XlLd2xr6W3c0NQl2GedB2WHNslU7pkwhW3Gwms7UnjgjVsevP6x1X:ewhWPUc7SxwsbyCdgA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1168 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
EXCEL.EXEpid process 1168 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1168 EXCEL.EXE 1168 EXCEL.EXE 1168 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1168 wrote to memory of 1112 1168 EXCEL.EXE splwow64.exe PID 1168 wrote to memory of 1112 1168 EXCEL.EXE splwow64.exe PID 1168 wrote to memory of 1112 1168 EXCEL.EXE splwow64.exe PID 1168 wrote to memory of 1112 1168 EXCEL.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\66d9b8923b9a0eadbbce1ab82a98abca897fe501c1e2f9b3f9544699531c5aad.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-59-0x0000000000000000-mapping.dmp
-
memory/1112-60-0x000007FEFC341000-0x000007FEFC343000-memory.dmpFilesize
8KB
-
memory/1168-54-0x000000002F801000-0x000000002F804000-memory.dmpFilesize
12KB
-
memory/1168-55-0x0000000071C11000-0x0000000071C13000-memory.dmpFilesize
8KB
-
memory/1168-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1168-57-0x0000000072BFD000-0x0000000072C08000-memory.dmpFilesize
44KB
-
memory/1168-58-0x0000000076401000-0x0000000076403000-memory.dmpFilesize
8KB
-
memory/1168-61-0x000000006D301000-0x000000006D303000-memory.dmpFilesize
8KB
-
memory/1168-62-0x0000000072BFD000-0x0000000072C08000-memory.dmpFilesize
44KB