322ee1a8d7f3f9f2814ccb12c2074ebd56781813eca0f06d83e07486018245f1

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

322ee1a8d7f3f9f2814ccb12c2074ebd56781813eca0f06d83e07486018245f1.xls
Size

36KB
MD5

7a51d386c11748d3b2c56d58d204089e
SHA1

8ce3cadda1112c2615190ea3047bc2608e3c1b3a
SHA256

322ee1a8d7f3f9f2814ccb12c2074ebd56781813eca0f06d83e07486018245f1
SHA512

a61f91adb9a12e02a9c55aa01fd62a194830861a2c308b0b91fe7e01ce8bdf81d8f86d8b8a61a586ecd30339b7d23765b49c9dd97b8d90c6c9a035acbdc62b9d
SSDEEP

768:OPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJS2VfcbFfIJTM2pKUglou0C:yok3hbdlylKsgqopeJBWhZFGkE+cL2NV

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

explorer.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3104	4964	explorer.exe	EXCEL.EXE

Blocklisted process makes network request 2 IoCs

Processes:

WScript.exe

flow pid process

21 948 WScript.exe
48 948 WScript.exe

flow	pid	process
21	948	WScript.exe
48	948	WScript.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings explorer.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4964 EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	explorer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EXCEL.EXEexplorer.exe

description	pid	process	target process
PID 4964 wrote to memory of 3104	4964	EXCEL.EXE	explorer.exe
PID 4964 wrote to memory of 3104	4964	EXCEL.EXE	explorer.exe
PID 4008 wrote to memory of 948	4008	explorer.exe	WScript.exe
PID 4008 wrote to memory of 948	4008	explorer.exe	WScript.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\322ee1a8d7f3f9f2814ccb12c2074ebd56781813eca0f06d83e07486018245f1.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\explorer.exe
explorer.exe C:\Users\Public\Documents\d7WcHFE.vbs
2⤵
- Process spawned unexpected child process
PID:3104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\d7WcHFE.vbs"
2⤵
- Blocklisted process makes network request
PID:948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\d7WcHFE.vbs
Filesize
577B

MD5
c67201cd6ceb002fe90667c8e1b4c6f0

SHA1
ead34962cb76bb06415d5e380054a553650652d4

SHA256
256691f64717a088ea6b75fc5ee621b2e03779fa31b8b3b05f905cbf1a54d514

SHA512
79133e032bb8d70ed98c48ff3547c335d6c45431198587a0b0123bd03dd451fa7cb85dfde241900122abc947f350051aeb306dc49be6ea2471c3a019205df53d

Download Submit
memory/948-144-0x0000000000000000-mapping.dmp

Download
memory/3104-142-0x0000000000000000-mapping.dmp

Download
memory/4964-135-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4964-136-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4964-137-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4964-138-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4964-139-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4964-140-0x00007FFCCB810000-0x00007FFCCB820000-memory.dmp

Filesize
64KB

Download
memory/4964-141-0x00007FFCCB810000-0x00007FFCCB820000-memory.dmp

Filesize
64KB

Download