28a83aa5bef94a8c26fea9f2817e53c341007a9c856f26e333d8a9922465182e

General

Target

LISTA COMENZILOR DE ACHIZIȚIE.xlam
Size

599KB
MD5

e4deac5ad957b116803f1fe586501dc8
SHA1

948c896aac7159fe8f7821943b415a9db2c260bc
SHA256

28a83aa5bef94a8c26fea9f2817e53c341007a9c856f26e333d8a9922465182e
SHA512

06146216510bfe5e225162eb8851948fb89eb402d071dceb082576fe2c11db1f17cbc94caecc7f23b91fce4356d2ef428bbee466afa00698855be7f5305da7a4
SSDEEP

12288:UTu/+Fx6EIM660RjZwbY/dkTDjlQYXJwkTx+naX:+x6EIBAY/MDwoz

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2280	3216	MSOXMLED.EXE	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3596	3216	MSOXMLED.EXE	80

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3216	EXCEL.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE
3216	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2280	3216	EXCEL.EXE	85
PID 3216 wrote to memory of 2280	3216	EXCEL.EXE	85
PID 3216 wrote to memory of 3596	3216	EXCEL.EXE	89
PID 3216 wrote to memory of 3596	3216	EXCEL.EXE	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\LISTA COMENZILOR DE ACHIZIȚIE.xlam"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\error032160_01.xml"
  2⤵
  - Process spawned unexpected child process
  PID:2280
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\error032160_01.xml"
  2⤵
  - Process spawned unexpected child process
  PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\error032160_01.xml

Filesize
474B

MD5
7501547793d470bd4e8f2ef4405b6167

SHA1
192213ce829b1aece79f5d8b222a39e3f05efed0

SHA256
ee03171793923df2e2da031deede04043e6bc15ea39d43d82019faf10eb6e438

SHA512
58ce4e282b36fe78f8755b4c77316ffd7546306597d086b4d4d7bedcdc08c39a766268cd6c96fee856efd8fef6a73b0f964c75d072a8ffbf6cb25c8289572a97

Download Submit
memory/2280-38-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/2280-50-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/2280-42-0x00007FFFA82D0000-0x00007FFFA82E0000-memory.dmp

Filesize
64KB

Download
memory/2280-41-0x00007FFFE59A0000-0x00007FFFE5C69000-memory.dmp

Filesize
2.8MB

Download
memory/2280-40-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/2280-39-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-8-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-20-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-9-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-10-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-11-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-12-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-13-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-15-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-16-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-14-0x00007FFFA5D20000-0x00007FFFA5D30000-memory.dmp

Filesize
64KB

Download
memory/3216-17-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-18-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-19-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-0-0x00007FFFA82D0000-0x00007FFFA82E0000-memory.dmp

Filesize
64KB

Download
memory/3216-21-0x00007FFFA5D20000-0x00007FFFA5D30000-memory.dmp

Filesize
64KB

Download
memory/3216-32-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-7-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-5-0x00007FFFA82D0000-0x00007FFFA82E0000-memory.dmp

Filesize
64KB

Download
memory/3216-6-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-4-0x00007FFFA82D0000-0x00007FFFA82E0000-memory.dmp

Filesize
64KB

Download
memory/3216-3-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3216-2-0x00007FFFA82D0000-0x00007FFFA82E0000-memory.dmp

Filesize
64KB

Download
memory/3216-1-0x00007FFFA82D0000-0x00007FFFA82E0000-memory.dmp

Filesize
64KB

Download
memory/3596-48-0x00007FFFE59A0000-0x00007FFFE5C69000-memory.dmp

Filesize
2.8MB

Download
memory/3596-49-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download
memory/3596-47-0x00007FFFE8250000-0x00007FFFE8445000-memory.dmp

Filesize
2.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads