4f61cbe170b2ebfc1f3278fe080f3a1d24e933b8bc63cfecd5de6bbbe2ed97d5

General

Target

597cf5f85f9255ae207cbd8af397d0ec.xls
Size

36KB
MD5

597cf5f85f9255ae207cbd8af397d0ec
SHA1

aa2f5ab185004bf683bce0171e8871b811ac352d
SHA256

4f61cbe170b2ebfc1f3278fe080f3a1d24e933b8bc63cfecd5de6bbbe2ed97d5
SHA512

ca7f11e26206c71a485293d626491155a1fa0dcea7763e383a739a80069f0912a7ec2db948138b2b28fa8a8a340d58a5e2cd8524071389ac42a6775f3b8b2525
SSDEEP

768:vPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ52cHVR4GgVeb9:Hok3hbdlylKsgqopeJBWhZFGkE+cL2Nk

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1144	2036	explorer.exe	31

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2036	EXCEL.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	EXCEL.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	EXCEL.EXE
2036	EXCEL.EXE
2036	EXCEL.EXE
2036	EXCEL.EXE
2036	EXCEL.EXE
2036	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1144	2036	EXCEL.EXE	95
PID 2036 wrote to memory of 1144	2036	EXCEL.EXE	95
PID 4848 wrote to memory of 3368	4848	explorer.exe	97
PID 4848 wrote to memory of 3368	4848	explorer.exe	97

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\597cf5f85f9255ae207cbd8af397d0ec.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\explorer.exe
  explorer.exe C:\Users\Public\Documents\lZqh7Z.vbs
  2⤵
  - Process spawned unexpected child process
  PID:1144

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\lZqh7Z.vbs"
  2⤵
  PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\lZqh7Z.vbs

Filesize
551B

MD5
9307fbc21979882a5ffd86a092e82f6a

SHA1
4fdbe330fe6a4c3cdb26d3cea46d6db57fd0586b

SHA256
84429130474d29382447b127f645ecd9d74e5a88c3c13f1817ae67acbbcc0d71

SHA512
a62dfdc0779b41c279bb1d8eec3553c7ef5f30855134b58b7f8bb4b4f48f25910af2777457655b3b385738b18337e3dab4105e1e0d771e6265ead37fe8bb5096

Download Submit
memory/2036-14-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-37-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-11-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-4-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-6-0x00007FFC64710000-0x00007FFC64720000-memory.dmp

Filesize
64KB

Download
memory/2036-5-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-8-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-9-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-7-0x00007FFC64710000-0x00007FFC64720000-memory.dmp

Filesize
64KB

Download
memory/2036-10-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-12-0x00007FFC62420000-0x00007FFC62430000-memory.dmp

Filesize
64KB

Download
memory/2036-13-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-3-0x00007FFC64710000-0x00007FFC64720000-memory.dmp

Filesize
64KB

Download
memory/2036-1-0x00007FFC64710000-0x00007FFC64720000-memory.dmp

Filesize
64KB

Download
memory/2036-22-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-16-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-17-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-18-0x00007FFC62420000-0x00007FFC62430000-memory.dmp

Filesize
64KB

Download
memory/2036-19-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-20-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-21-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-15-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-2-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-34-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-35-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-36-0x00007FFCA4690000-0x00007FFCA4885000-memory.dmp

Filesize
2.0MB

Download
memory/2036-0-0x00007FFC64710000-0x00007FFC64720000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads