825df25db4e5ed8af1ea2841ad2942b201777dd570e036c2da3b8dce083da198

General

Target

c375ca5ba420b9cf96ab566fd276b4b6.xls
Size

1.3MB
MD5

c375ca5ba420b9cf96ab566fd276b4b6
SHA1

7759a1370a5eca8d9edda523c32d9c7f90883258
SHA256

825df25db4e5ed8af1ea2841ad2942b201777dd570e036c2da3b8dce083da198
SHA512

b686b93af6fd373f8475a960948c2aaff329e2e93b7ac6844394d0d0bc8fe3b4fad182ec4180a36b1560c1e54b709e7e0ef6fc93f0769d9e84d7336b947bb86e
SSDEEP

24576:Q5o76oMMouIqjwUalD6crmnwu9RG/VFRj1Kn1abTdGchqecFcJgORqoX:MMbIqjtawvwu9RGdrjQn1afMcYMbqoX

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1992	4100	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2976	4100	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3176	4100	cmd.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\F7B65E00\:Zone.Identifier:$DATA EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4100 EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\F7B65E00\:Zone.Identifier:$DATA	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXEcmd.exe

description	pid	process	target process
PID 4100 wrote to memory of 1992	4100	EXCEL.EXE	cmd.exe
PID 4100 wrote to memory of 1992	4100	EXCEL.EXE	cmd.exe
PID 4100 wrote to memory of 3176	4100	EXCEL.EXE	cmd.exe
PID 4100 wrote to memory of 3176	4100	EXCEL.EXE	cmd.exe
PID 4100 wrote to memory of 2976	4100	EXCEL.EXE	cmd.exe
PID 4100 wrote to memory of 2976	4100	EXCEL.EXE	cmd.exe
PID 1992 wrote to memory of 696	1992	cmd.exe	attrib.exe
PID 1992 wrote to memory of 696	1992	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

696 attrib.exe

pid	process
696	attrib.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c375ca5ba420b9cf96ab566fd276b4b6.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\system32\attrib.exe
attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
3⤵
- Views/modifies file attributes
PID:696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
2⤵
- Process spawned unexpected child process
PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
2⤵
- Process spawned unexpected child process
PID:3176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c375ca5ba420b9cf96ab566fd276b4b6.xls
Filesize
1.3MB

MD5
17d449ac4101dc6feb618887e4081d98

SHA1
b3c4f54f8b11316a57d5e2ae46b99633e340a3b8

SHA256
1d99292279063f48d582f2695bcc5fc9006f2b621d5968fb96f7a66c12b5f061

SHA512
9c5736489efb26526adec8f1cf29ece7063a9e2f7823dac32e22041a84e67e582046f2558ccaa9bcb559210a6f8d8df01f19b54225630c348fad75b77b9a8109

Download Submit
memory/4100-133-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download
memory/4100-135-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download
memory/4100-134-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download
memory/4100-136-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download
memory/4100-137-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download
memory/4100-138-0x00007FF995E50000-0x00007FF995E60000-memory.dmp

Filesize
64KB

Download
memory/4100-139-0x00007FF995E50000-0x00007FF995E60000-memory.dmp

Filesize
64KB

Download
memory/4100-225-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download
memory/4100-226-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download
memory/4100-227-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download
memory/4100-228-0x00007FF9987B0000-0x00007FF9987C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads