432cebccecceaabb348628f2ea339f680fbc6c8a7bfbb1d9fc549d205b07790b

Analysis

max time kernel
0s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59a0e50522a04f35675c5b45f93b4133.xls
Size

36KB
MD5

59a0e50522a04f35675c5b45f93b4133
SHA1

72ff67f083e14227002d8e340c834a7c8bff2135
SHA256

432cebccecceaabb348628f2ea339f680fbc6c8a7bfbb1d9fc549d205b07790b
SHA512

7911fcb80007242d019184d5e2036f3d012f479194d6f9a9793d3863f2c60fa84e9fc49aa07a2f7c29da062c8a32c9f24ac4388ba4b823ebb2fb7beadc7c749b
SSDEEP

768:NPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjl5K6e5OBXwUe8dV:lok3hbdlylKsgqopeJBWhZFGkE+cL2N0

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2612	1712	rundll32.exe	16

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\59a0e50522a04f35675c5b45f93b4133.xls
1⤵
- Modifies Internet Explorer settings
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Users\Public\Documents\e5zb.txt,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1712-1-0x00000000720FD000-0x0000000072108000-memory.dmp

Filesize
44KB

Download
memory/1712-2-0x00000000720FD000-0x0000000072108000-memory.dmp

Filesize
44KB

Download
memory/1712-3-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1712-4-0x00000000720FD000-0x0000000072108000-memory.dmp

Filesize
44KB

Download