Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 09:36
Static task
static1
Behavioral task
behavioral1
Sample
a8d31615714628c60a43b42327534c63.xls
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a8d31615714628c60a43b42327534c63.xls
Resource
win10v2004-20240226-en
General
-
Target
a8d31615714628c60a43b42327534c63.xls
-
Size
1014KB
-
MD5
a8d31615714628c60a43b42327534c63
-
SHA1
7079943b612e427ada6a4e0bd9d1bba80501a58e
-
SHA256
7e962d426bd5b1df9b48697741f47ba5275b1d730dae04d370ded8a20282f82f
-
SHA512
ef390604e1de9bc47a7e4302e32c2b9a63b4b5fd80fb9eb2a6be01be37cdfa20f9d44641a8136067f7d6cc71492706b74f786b576cfc225a58c040dfd69500b9
-
SSDEEP
12288:4A579njioXPKBCe2N0LfIZiAhe92KW70TJoE2Ij:77rmIbe9HoE2Ij
Malware Config
Signatures
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2540 1676 cmd.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2424 1676 cmd.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2452 1676 cmd.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2448 1676 cmd.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2884 1676 cmd.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 272 1676 cmd.exe EXCEL.EXE -
Office macro that triggers on suspicious action 2 IoCs
Office document macro which triggers in special circumstances - often malicious.
Processes:
resource yara_rule \??\c:\norma1.xlm office_macro_on_action C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\3FFECCAC.tmp office_macro_on_action -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2316 attrib.exe 1128 attrib.exe -
Processes:
resource yara_rule \??\c:\norma1.xlm office_xlm_macros C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\3FFECCAC.tmp office_xlm_macros -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet.exe = "internet.exe" EXCEL.EXE -
Drops file in System32 directory 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File created C:\Windows\SysWOW64\internet.exe EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
WINWORD.EXEEXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1676 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
EXCEL.EXEpid process 1676 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
EXCEL.EXEWINWORD.EXEpid process 1676 EXCEL.EXE 1676 EXCEL.EXE 1676 EXCEL.EXE 1676 EXCEL.EXE 1676 EXCEL.EXE 2876 WINWORD.EXE 2876 WINWORD.EXE -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
EXCEL.EXEcmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1676 wrote to memory of 2960 1676 EXCEL.EXE splwow64.exe PID 1676 wrote to memory of 2960 1676 EXCEL.EXE splwow64.exe PID 1676 wrote to memory of 2960 1676 EXCEL.EXE splwow64.exe PID 1676 wrote to memory of 2960 1676 EXCEL.EXE splwow64.exe PID 1676 wrote to memory of 2540 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2540 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2540 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2540 1676 EXCEL.EXE cmd.exe PID 2540 wrote to memory of 2668 2540 cmd.exe attrib.exe PID 2540 wrote to memory of 2668 2540 cmd.exe attrib.exe PID 2540 wrote to memory of 2668 2540 cmd.exe attrib.exe PID 2540 wrote to memory of 2668 2540 cmd.exe attrib.exe PID 1676 wrote to memory of 2424 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2424 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2424 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2424 1676 EXCEL.EXE cmd.exe PID 2424 wrote to memory of 2680 2424 cmd.exe attrib.exe PID 2424 wrote to memory of 2680 2424 cmd.exe attrib.exe PID 2424 wrote to memory of 2680 2424 cmd.exe attrib.exe PID 2424 wrote to memory of 2680 2424 cmd.exe attrib.exe PID 1676 wrote to memory of 2452 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2452 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2452 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2452 1676 EXCEL.EXE cmd.exe PID 2452 wrote to memory of 2440 2452 cmd.exe extrac32.exe PID 2452 wrote to memory of 2440 2452 cmd.exe extrac32.exe PID 2452 wrote to memory of 2440 2452 cmd.exe extrac32.exe PID 2452 wrote to memory of 2440 2452 cmd.exe extrac32.exe PID 1676 wrote to memory of 2448 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2448 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2448 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2448 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2884 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2884 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2884 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 2884 1676 EXCEL.EXE cmd.exe PID 2884 wrote to memory of 2316 2884 cmd.exe attrib.exe PID 2884 wrote to memory of 2316 2884 cmd.exe attrib.exe PID 2884 wrote to memory of 2316 2884 cmd.exe attrib.exe PID 2884 wrote to memory of 2316 2884 cmd.exe attrib.exe PID 1676 wrote to memory of 272 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 272 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 272 1676 EXCEL.EXE cmd.exe PID 1676 wrote to memory of 272 1676 EXCEL.EXE cmd.exe PID 272 wrote to memory of 1128 272 cmd.exe attrib.exe PID 272 wrote to memory of 1128 272 cmd.exe attrib.exe PID 272 wrote to memory of 1128 272 cmd.exe attrib.exe PID 272 wrote to memory of 1128 272 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 4 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exepid process 2668 attrib.exe 2680 attrib.exe 2316 attrib.exe 1128 attrib.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a8d31615714628c60a43b42327534c63.xls1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2960
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c attrib -s -h c:\setflag.exe2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h c:\setflag.exe3⤵
- Views/modifies file attributes
PID:2668 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c attrib -s -h c:\sendto.exe2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h c:\sendto.exe3⤵
- Views/modifies file attributes
PID:2680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c extrac32 /E /Y /L c:\ c:\cab.cab2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\extrac32.exeextrac32 /E /Y /L c:\ c:\cab.cab3⤵PID:2440
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c extract /E /Y /L c:\ c:\cab.cab2⤵
- Process spawned unexpected child process
PID:2448 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c attrib +s +h c:\setflag.exe2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\attrib.exeattrib +s +h c:\setflag.exe3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2316 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c attrib +s +h c:\sendto.exe2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\attrib.exeattrib +s +h c:\sendto.exe3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1128
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5487dfbaac4f2d2b3f32c5551ec87b289
SHA1d670f6a76306151cbe86526f262d7fde323971ea
SHA256e9edb4e2a06a921feb8ee4c35a402c98df9a48605561fc83a5f33800ed6c9c4e
SHA512904909e41a97c336d7753c4289d3d6fcaefca65ebcbe789d314dbdca57ba859f775a170d9fb8ca8e09180b20c268d99a46ecdad30803395a0a0f4685ecc727cd
-
Filesize
20KB
MD5c8c11b0f97be5df4019d7694b6039902
SHA100903505291654a8a7988c617b9c2cac7487805b
SHA256327baafb75e4cb3de4bb433e21b45ec35b8f610fb64113019eb3ab6d5d173e49
SHA512d937ab44b9d3cf9775719d221a12994458dba29aae19dba268f8c6f3b77f12a0e2b8c31191f15755e02005e99ae18bba5abd57c886903fcc607598be2dd52044
-
Filesize
20KB
MD556bafcef305ce46d847421edd6eec04b
SHA1e6e31dda260fee10b63c4dd297b433749ea7ac07
SHA2563c6d90fdf13ef66dd36631796cd50db01dfb8e2db5b472c45202513ab816f272
SHA512c78210f40daa6e2827d1280eaca5ae22cf036d20ff802826171cfdaf2b64a011f32c8689eec174d3375e197b240e4c92a2fb466b01c66a96e9276cd1de160e20
-
Filesize
32KB
MD5a4f9be8517afb4c5d9c63960a5faf258
SHA16d3300bfc43b191819f687df91bfbe2c6294d6bb
SHA25678b6db289832df709d17fd5c49359ddfb9cacaa8303cd77290427bac4c829ba2
SHA512c6c918bc91ed645553245cc640ed66882af264035732b8a8c2682f14a9c8f183c38837c1b3e62ca7d16e1560e6bc2a4273b41c9614a046752928c9a0c45ecb2e
-
Filesize
70KB
MD55a876443f36ca54efae1c723041435c0
SHA17ebd6188c3df725008209b7d24f914b2b3ce0a6c
SHA25602397a86f99f98f212adee047d25c56fa6644a3cf6058ddb0da0221d708f1ee9
SHA512a065a1ed747b8348c49c909e7186da584a3f01bca4652b154d5f7f88c4de15c5f0c03884db5cf33bca9035944cf5c7bc6983571301dd0fa4d7c298942887a149
-
Filesize
24KB
MD5072ca9f791665febeacda1be1e71a124
SHA120d6d75ef7e06c72b43a2e3be81f5ceab11a1a5a
SHA256692bfa3ca595a0ed57dd1d5fa6652332162c90ea0c9b8c9b32ddbebbec063f3d
SHA5123cd1c0727085dcc054b1c9111c934fef3473d57a91e1e247418a220e35c59e495282740621d6c9c01c86a39ad4e5c79d7d95dbd289e25f044cfad1f616d52290
-
Filesize
68KB
MD53f08a7010fe4ea32b210b7919448ada6
SHA1c7bc3bb8f78ef217b83c593542b5c4cf602746a2
SHA256506260a97f723ce79e3243b651dc8af1c3fcdbf72431be60b1a0afbab8d2dce9
SHA512be8ac3dcb6574e6876c2f8d2e40c1c6ad75ca611275ccc73c7283f6b17f3956c16c14d9dfa10e36576011baa691378a8ce6115e380b821a2d6f549ea46567b4c
-
Filesize
103KB
MD526ab77fe4d542805e0afdc9d0efc92c2
SHA1332dc776b13e8f04809a312183ef9532ea2b18d3
SHA2561cb2d969e56664ddc1f496c63e424cbe1ce2f560f8350f4ffa451f0fc03006d9
SHA512ef439dbbe390eb175bd9970d76827a6b506b88a4db7cda233d8b6591b22e3c7a454cbb8111ca78dbbd6b195c91aa89c7d0c9df952052d3471eb07ac80f98b89a