d5fd9f154b78723434a34da893129c0aaae237355eacec9e53a85425d64767c5

General

Target

d5fd9f154b78723434a34da893129c0aaae237355eacec9e53a85425d64767c5.xls
Size

58KB
MD5

6d2d680fa88341b1920538aa105fab88
SHA1

ea2176911810bcb47ae7df41750117246cb2ff52
SHA256

d5fd9f154b78723434a34da893129c0aaae237355eacec9e53a85425d64767c5
SHA512

a5a472eb3392aae20162aa6585437587055b61a1f8e4038140d7fa362b96f173556221ea1bf633c2d7e0d6706f4fa5ded9f82ac3401049c6ea80492858f90868
SSDEEP

768:MrrrfC+2XR2HqUMLFz0kTKiMY3og/1JFNhSenFZctwFiJtF26mDF5dIXF7rF/0qK:MrrrfC+2wp2+3IRaD7NTe

Score

10^/10

evasion persistence

Malware Config

Signatures

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	220	3836	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3812	3836	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4052	3836	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4408	3836	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4592	3836	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4612	3836	cmd.exe	EXCEL.EXE

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4608 attrib.exe
3124 attrib.exe

pid	process
4608	attrib.exe
3124	attrib.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet.exe = "internet.exe"	EXCEL.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEWINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

EXCEL.EXEWINWORD.EXE

pid process

3836 EXCEL.EXE
2260 WINWORD.EXE

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

EXCEL.EXEWINWORD.EXE

pid	process
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
3836	EXCEL.EXE
2260	WINWORD.EXE
2260	WINWORD.EXE
2260	WINWORD.EXE
3836	EXCEL.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

EXCEL.EXEcmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3836 wrote to memory of 220	3836	EXCEL.EXE	cmd.exe
PID 3836 wrote to memory of 220	3836	EXCEL.EXE	cmd.exe
PID 220 wrote to memory of 3908	220	cmd.exe	attrib.exe
PID 220 wrote to memory of 3908	220	cmd.exe	attrib.exe
PID 3836 wrote to memory of 3812	3836	EXCEL.EXE	cmd.exe
PID 3836 wrote to memory of 3812	3836	EXCEL.EXE	cmd.exe
PID 3812 wrote to memory of 744	3812	cmd.exe	attrib.exe
PID 3812 wrote to memory of 744	3812	cmd.exe	attrib.exe
PID 3836 wrote to memory of 4052	3836	EXCEL.EXE	cmd.exe
PID 3836 wrote to memory of 4052	3836	EXCEL.EXE	cmd.exe
PID 4052 wrote to memory of 1072	4052	cmd.exe	extrac32.exe
PID 4052 wrote to memory of 1072	4052	cmd.exe	extrac32.exe
PID 3836 wrote to memory of 4408	3836	EXCEL.EXE	cmd.exe
PID 3836 wrote to memory of 4408	3836	EXCEL.EXE	cmd.exe
PID 3836 wrote to memory of 4592	3836	EXCEL.EXE	cmd.exe
PID 3836 wrote to memory of 4592	3836	EXCEL.EXE	cmd.exe
PID 4592 wrote to memory of 4608	4592	cmd.exe	attrib.exe
PID 4592 wrote to memory of 4608	4592	cmd.exe	attrib.exe
PID 3836 wrote to memory of 4612	3836	EXCEL.EXE	cmd.exe
PID 3836 wrote to memory of 4612	3836	EXCEL.EXE	cmd.exe
PID 4612 wrote to memory of 3124	4612	cmd.exe	attrib.exe
PID 4612 wrote to memory of 3124	4612	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 4 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

4608 attrib.exe
3124 attrib.exe
3908 attrib.exe
744 attrib.exe

pid	process
4608	attrib.exe
3124	attrib.exe
3908	attrib.exe
744	attrib.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d5fd9f154b78723434a34da893129c0aaae237355eacec9e53a85425d64767c5.xls"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c attrib -s -h c:\setflag.exe
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\system32\attrib.exe
attrib -s -h c:\setflag.exe
3⤵
- Views/modifies file attributes
PID:3908

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c attrib -s -h c:\sendto.exe
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\system32\attrib.exe
attrib -s -h c:\sendto.exe
3⤵
- Views/modifies file attributes
PID:744

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c extrac32 /E /Y /L c:\ c:\cab.cab
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\system32\extrac32.exe
extrac32 /E /Y /L c:\ c:\cab.cab
3⤵
PID:1072

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c extract /E /Y /L c:\ c:\cab.cab
2⤵
- Process spawned unexpected child process
PID:4408

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c attrib +s +h c:\setflag.exe
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\system32\attrib.exe
attrib +s +h c:\setflag.exe
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4608

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c attrib +s +h c:\sendto.exe
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4612

C:\Windows\system32\attrib.exe
attrib +s +h c:\sendto.exe
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3124

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Filesize
471B

MD5
302ccc431609cad913893a5762258293

SHA1
c88d15ce7198f7296e281fd342d621618a1eddb9

SHA256
3963c5a71bd7299478ffdb264b1e8d812aa9598d8d74413ab29268a0545fccb5

SHA512
520870fd7d55484064ec7950fd74646140a240cec3261691807dbb857f2a6285d587ebfa34a70d122f9cb9b5d59ca0441e965648eb592333d90fa29ef7f42b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Filesize
446B

MD5
478ee133074ae296f0fb8b137823e105

SHA1
82aeb4bd41701c3c259a3551b123657899462541

SHA256
17816331957760127b60714169ee886f92135bec7fa3c5a48692f83f91888403

SHA512
415bbe463a8231c07f1326b0323f8f6b870e8d1894f0f26a91589f88c75fd7025868e260aa65748e72761f45559151d38f64228a9bfb25f5a72022c45316444e

Download Submit
memory/220-139-0x0000000000000000-mapping.dmp

Download
memory/744-142-0x0000000000000000-mapping.dmp

Download
memory/1072-144-0x0000000000000000-mapping.dmp

Download
memory/2260-163-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/2260-162-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/2260-161-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/2260-160-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/3124-157-0x0000000000000000-mapping.dmp

Download
memory/3812-141-0x0000000000000000-mapping.dmp

Download
memory/3836-137-0x00007FF925010000-0x00007FF925020000-memory.dmp

Filesize
64KB

Download
memory/3836-132-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/3836-135-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/3836-133-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/3836-134-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/3836-136-0x00007FF927810000-0x00007FF927820000-memory.dmp

Filesize
64KB

Download
memory/3836-138-0x00007FF925010000-0x00007FF925020000-memory.dmp

Filesize
64KB

Download
memory/3908-140-0x0000000000000000-mapping.dmp

Download
memory/4052-143-0x0000000000000000-mapping.dmp

Download
memory/4408-145-0x0000000000000000-mapping.dmp

Download
memory/4592-153-0x0000000000000000-mapping.dmp

Download
memory/4608-155-0x0000000000000000-mapping.dmp

Download
memory/4612-156-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads