Analysis
-
max time kernel
208s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 17:16
Behavioral task
behavioral1
Sample
~ar6759.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
~ar6759.xls
Resource
win10v2004-20220901-en
General
-
Target
~ar6759.xls
-
Size
107KB
-
MD5
ae89cf6ba9007c82060c00e004ca8a1e
-
SHA1
c25329af0c5edd0260744a89f25c36ae336c5792
-
SHA256
2609fc43379c7572ab4b9e15ca5b8408c42b071caceb6e45384b85b30df60979
-
SHA512
5c4fcfeaaca3dc6195c913cce1aa8ee9c394cfd11e4ccab373bd7b83c6bb70f84f78af10bf01525810a382baf118424b2404f7b5ef7717fb7b3901f19cd3e8ab
-
SSDEEP
3072:8i9QUDGYwk/u1Q5y21afgjs8KA6bLhmvjKESzz6u/lmpYj:8i9QUDGYwk/u1Q5y21afgjs8KA6bLhmq
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2000 3464 rundll32.exe EXCEL.EXE -
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 30 2000 rundll32.exe 33 2000 rundll32.exe 65 2000 rundll32.exe 67 2000 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3464 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 27 IoCs
Processes:
EXCEL.EXEpid process 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe PID 3464 wrote to memory of 2000 3464 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\~ar6759.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2000-139-0x0000000002E80000-0x0000000003280000-memory.dmpFilesize
4.0MB
-
memory/2000-140-0x0000000002E80000-0x0000000003280000-memory.dmpFilesize
4.0MB
-
memory/3464-132-0x00007FF83FCF0000-0x00007FF83FD00000-memory.dmpFilesize
64KB
-
memory/3464-133-0x00007FF83FCF0000-0x00007FF83FD00000-memory.dmpFilesize
64KB
-
memory/3464-134-0x00007FF83FCF0000-0x00007FF83FD00000-memory.dmpFilesize
64KB
-
memory/3464-135-0x00007FF83FCF0000-0x00007FF83FD00000-memory.dmpFilesize
64KB
-
memory/3464-136-0x00007FF83FCF0000-0x00007FF83FD00000-memory.dmpFilesize
64KB
-
memory/3464-137-0x00007FF83D570000-0x00007FF83D580000-memory.dmpFilesize
64KB
-
memory/3464-138-0x00007FF83D570000-0x00007FF83D580000-memory.dmpFilesize
64KB