3861795ece849d6b417a3c9870a7e0a0eccd27f74e706b9242d94d5e8885b705

Analysis

max time kernel
100s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b54c993e941836bf2c9c69948b30bcf0.xlsm
Size

35KB
MD5

b54c993e941836bf2c9c69948b30bcf0
SHA1

a3e6234b5310a3918b9e01c08badf3eb5f44a4b8
SHA256

3861795ece849d6b417a3c9870a7e0a0eccd27f74e706b9242d94d5e8885b705
SHA512

cda8807707e6ee42309df106c3c3f8daf1c63b154dbee9741ca25679732d6e61a36fc6dbbd1ca76b8d444296ba5001cafe57d11c6ded384451d71cbef7cc80f1
SSDEEP

768:YLsShCAVaV5WqShv3H4+jbXAAQpyQyAtewZP8a88ULsR6LQkZt5mZ2:YbhCLVkqStYuQgrCl38896LbZt5mQ

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	632	1308	mshta.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1308 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

1308 EXCEL.EXE
1308 EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

EXCEL.EXE

pid	process
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE
1308	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description pid process target process

PID 1308 wrote to memory of 632 1308 EXCEL.EXE mshta.exe
PID 1308 wrote to memory of 632 1308 EXCEL.EXE mshta.exe

description	pid	process	target process
PID 1308 wrote to memory of 632	1308	EXCEL.EXE	mshta.exe
PID 1308 wrote to memory of 632	1308	EXCEL.EXE	mshta.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b54c993e941836bf2c9c69948b30bcf0.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SYSTEM32\mshta.exe
mshta C:\Users\Admin\AppData\Local\Temp\LwTHLrGh.hta
2⤵
- Process spawned unexpected child process
PID:632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LwTHLrGh.hta
Filesize
17KB

MD5
084149c0fc6722b43b42ebc96f22effe

SHA1
d40525e84d7da7f2e193a4e2fc2a24739dc88027

SHA256
8d74853d271ec7a12880c4e33591df212628e3cb6a2f4038adad28c4b6891a96

SHA512
193a745b3bed038168d7523e9d7f670e62bf4f6ba81b4117a3c80b9c848b3ac69059bc3c4ab72eee41d4defacc32249cd9df1b6683c088eb820e54fa85d7280c

Download Submit
memory/1308-139-0x00007FFE17400000-0x00007FFE17410000-memory.dmp

Filesize
64KB

Download
memory/1308-135-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download
memory/1308-136-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download
memory/1308-137-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download
memory/1308-138-0x00007FFE17400000-0x00007FFE17410000-memory.dmp

Filesize
64KB

Download
memory/1308-133-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download
memory/1308-160-0x0000022238DA0000-0x0000022238FA0000-memory.dmp

Filesize
2.0MB

Download
memory/1308-134-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download
memory/1308-174-0x0000022238DA0000-0x0000022238FA0000-memory.dmp

Filesize
2.0MB

Download
memory/1308-185-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download
memory/1308-186-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download
memory/1308-187-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download
memory/1308-188-0x00007FFE19930000-0x00007FFE19940000-memory.dmp

Filesize
64KB

Download