1a6ac9f7ca271aa203dd593c52d85e2e582582cea63147376bac10f6a5d670c4

General

Target

f2a1c9975103b64aed0a66739cadd62f.xls
Size

115KB
MD5

f2a1c9975103b64aed0a66739cadd62f
SHA1

c22b66c0be9da1246c7fc3ff7f61eef53c9077f5
SHA256

1a6ac9f7ca271aa203dd593c52d85e2e582582cea63147376bac10f6a5d670c4
SHA512

c518e44d308cef678dece6e21e6315b9b0639c24acbeb06adac12629fd7b22c7abc87649c2d6f241fe2bb2afd1c0d20e4d0b1c9eaaac8249554c0cf59a030312
SSDEEP

1536:iCCCzXPHmQv3ePaz4z1/sjLRSbfzvyjIRX3OglgA53NRKBqZncJtXw8lo0UviBub:kyjIFOglgA53NRKEmJtXwJOITpRyTW

Score

10^/10

macro xlm

Malware Config

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4660	684	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	996	684	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4900	684	cmd.exe	EXCEL.EXE

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\f2a1c9975103b64aed0a66739cadd62f.xls	office_xlm_macros

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\33D65E00\:Zone.Identifier:$DATA EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

684 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

684 EXCEL.EXE
684 EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\33D65E00\:Zone.Identifier:$DATA	EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE
684	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXEcmd.exe

description	pid	process	target process
PID 684 wrote to memory of 4660	684	EXCEL.EXE	cmd.exe
PID 684 wrote to memory of 4660	684	EXCEL.EXE	cmd.exe
PID 684 wrote to memory of 996	684	EXCEL.EXE	cmd.exe
PID 684 wrote to memory of 996	684	EXCEL.EXE	cmd.exe
PID 684 wrote to memory of 4900	684	EXCEL.EXE	cmd.exe
PID 684 wrote to memory of 4900	684	EXCEL.EXE	cmd.exe
PID 4660 wrote to memory of 4524	4660	cmd.exe	attrib.exe
PID 4660 wrote to memory of 4524	4660	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4524 attrib.exe

pid	process
4524	attrib.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f2a1c9975103b64aed0a66739cadd62f.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\system32\attrib.exe
attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
3⤵
- Views/modifies file attributes
PID:4524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
2⤵
- Process spawned unexpected child process
PID:996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
2⤵
- Process spawned unexpected child process
PID:4900

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f2a1c9975103b64aed0a66739cadd62f.xls
Filesize
115KB

MD5
58036ac9590cc77ad6098ccbb5e897db

SHA1
159bae21a6ba4263c390719b3236ceebe07abc83

SHA256
aff29f0984fc7ef2bbe5c3b1869a1d1e282734a3a1f8c8c62338ef7f8bcb8fba

SHA512
c9c218f59fca18ea84ebda8389207b838b024abf560674b6e437b250a472040f4c4067131e3c113f5aab62d5de8c80909724141f70d0a2f5af6f1e1355dd877c

Download Submit
memory/684-133-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download
memory/684-135-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download
memory/684-134-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download
memory/684-136-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download
memory/684-137-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download
memory/684-138-0x00007FFD66D00000-0x00007FFD66D10000-memory.dmp

Filesize
64KB

Download
memory/684-139-0x00007FFD66D00000-0x00007FFD66D10000-memory.dmp

Filesize
64KB

Download
memory/684-227-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download
memory/684-228-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download
memory/684-229-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download
memory/684-230-0x00007FFD68E90000-0x00007FFD68EA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads