Analysis
-
max time kernel
101s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 08:45
Behavioral task
behavioral1
Sample
d2eb5114b80fe22c9b24917cbc1353be.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d2eb5114b80fe22c9b24917cbc1353be.xls
Resource
win10v2004-20230221-en
General
-
Target
d2eb5114b80fe22c9b24917cbc1353be.xls
-
Size
808KB
-
MD5
d2eb5114b80fe22c9b24917cbc1353be
-
SHA1
f45402466a8f640e649b20d996b366cc631ee24c
-
SHA256
85df8a9699d70ec3fe2ea3da9d961552df49971bc121d45fa640546574ec0a4c
-
SHA512
47feaee48042e0d1b9287ac6adf3529001da39188f9bf5b36f3123a92216de7f0ca0d6648a7d42ba12021adb8452aad63f0af85542c5822687aa35673fb85e6d
-
SSDEEP
6144:Wk3hOdsylKlgryzc4bNhZF+E+W2kn81CawW0Haq6LyY1IZ9mkqmaLmzGinJ2H/t:8AYaS4JOQYeORI
Malware Config
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.execmd.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2080 4828 cmd.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4116 4828 cmd.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2280 4828 cmd.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
NTFS ADS 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File created C:\Users\Admin\AppData\Local\Temp\CFA65E00\:Zone.Identifier:$DATA EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4828 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4828 EXCEL.EXE 4828 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE 4828 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEcmd.exedescription pid process target process PID 4828 wrote to memory of 2080 4828 EXCEL.EXE cmd.exe PID 4828 wrote to memory of 2080 4828 EXCEL.EXE cmd.exe PID 4828 wrote to memory of 2280 4828 EXCEL.EXE cmd.exe PID 4828 wrote to memory of 2280 4828 EXCEL.EXE cmd.exe PID 4828 wrote to memory of 4116 4828 EXCEL.EXE cmd.exe PID 4828 wrote to memory of 4116 4828 EXCEL.EXE cmd.exe PID 2080 wrote to memory of 1448 2080 cmd.exe attrib.exe PID 2080 wrote to memory of 1448 2080 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d2eb5114b80fe22c9b24917cbc1353be.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d2eb5114b80fe22c9b24917cbc1353be.xlsFilesize
822KB
MD5620204f75f3b052c4b70d0d812658896
SHA1da1dd63348037fd779162d06ccc2f81a2be4fb18
SHA25667db429e8387d9395122106259fd2a999fb94104e3ff527eac5be179fb581b71
SHA5124b65dc4438131f023d248819f3e52cb8558bbd87eee22dca5f88048c8dd6fd0148e233f0b72c60c983974d132cb22e0e63633e58a90dfd8d535a9a996dd8e61d
-
memory/4828-133-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB
-
memory/4828-134-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB
-
memory/4828-135-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB
-
memory/4828-136-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB
-
memory/4828-137-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB
-
memory/4828-138-0x00007FFC8B5E0000-0x00007FFC8B5F0000-memory.dmpFilesize
64KB
-
memory/4828-139-0x00007FFC8B5E0000-0x00007FFC8B5F0000-memory.dmpFilesize
64KB
-
memory/4828-227-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB
-
memory/4828-228-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB
-
memory/4828-229-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB
-
memory/4828-230-0x00007FFC8D6D0000-0x00007FFC8D6E0000-memory.dmpFilesize
64KB