Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-02-2024 09:36

General

  • Target

    a8d31615714628c60a43b42327534c63.xls

  • Size

    1014KB

  • MD5

    a8d31615714628c60a43b42327534c63

  • SHA1

    7079943b612e427ada6a4e0bd9d1bba80501a58e

  • SHA256

    7e962d426bd5b1df9b48697741f47ba5275b1d730dae04d370ded8a20282f82f

  • SHA512

    ef390604e1de9bc47a7e4302e32c2b9a63b4b5fd80fb9eb2a6be01be37cdfa20f9d44641a8136067f7d6cc71492706b74f786b576cfc225a58c040dfd69500b9

  • SSDEEP

    12288:4A579njioXPKBCe2N0LfIZiAhe92KW70TJoE2Ij:77rmIbe9HoE2Ij

Malware Config

Signatures

  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Office macro that triggers on suspicious action 2 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Suspicious Office macro 2 IoCs

    Office document equipped with 4.0 macros.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a8d31615714628c60a43b42327534c63.xls
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2960
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c attrib -s -h c:\setflag.exe
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\SysWOW64\attrib.exe
          attrib -s -h c:\setflag.exe
          3⤵
          • Views/modifies file attributes
          PID:2668
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c attrib -s -h c:\sendto.exe
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Windows\SysWOW64\attrib.exe
          attrib -s -h c:\sendto.exe
          3⤵
          • Views/modifies file attributes
          PID:2680
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c extrac32 /E /Y /L c:\ c:\cab.cab
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\SysWOW64\extrac32.exe
          extrac32 /E /Y /L c:\ c:\cab.cab
          3⤵
            PID:2440
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c extract /E /Y /L c:\ c:\cab.cab
          2⤵
          • Process spawned unexpected child process
          PID:2448
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c attrib +s +h c:\setflag.exe
          2⤵
          • Process spawned unexpected child process
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Windows\SysWOW64\attrib.exe
            attrib +s +h c:\setflag.exe
            3⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:2316
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c attrib +s +h c:\sendto.exe
          2⤵
          • Process spawned unexpected child process
          • Suspicious use of WriteProcessMemory
          PID:272
          • C:\Windows\SysWOW64\attrib.exe
            attrib +s +h c:\sendto.exe
            3⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:1128
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2876

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\3FFECCAC.tmp

        Filesize

        68KB

        MD5

        487dfbaac4f2d2b3f32c5551ec87b289

        SHA1

        d670f6a76306151cbe86526f262d7fde323971ea

        SHA256

        e9edb4e2a06a921feb8ee4c35a402c98df9a48605561fc83a5f33800ed6c9c4e

        SHA512

        904909e41a97c336d7753c4289d3d6fcaefca65ebcbe789d314dbdca57ba859f775a170d9fb8ca8e09180b20c268d99a46ecdad30803395a0a0f4685ecc727cd

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

        Filesize

        20KB

        MD5

        c8c11b0f97be5df4019d7694b6039902

        SHA1

        00903505291654a8a7988c617b9c2cac7487805b

        SHA256

        327baafb75e4cb3de4bb433e21b45ec35b8f610fb64113019eb3ab6d5d173e49

        SHA512

        d937ab44b9d3cf9775719d221a12994458dba29aae19dba268f8c6f3b77f12a0e2b8c31191f15755e02005e99ae18bba5abd57c886903fcc607598be2dd52044

      • C:\sendto.exe

        Filesize

        20KB

        MD5

        56bafcef305ce46d847421edd6eec04b

        SHA1

        e6e31dda260fee10b63c4dd297b433749ea7ac07

        SHA256

        3c6d90fdf13ef66dd36631796cd50db01dfb8e2db5b472c45202513ab816f272

        SHA512

        c78210f40daa6e2827d1280eaca5ae22cf036d20ff802826171cfdaf2b64a011f32c8689eec174d3375e197b240e4c92a2fb466b01c66a96e9276cd1de160e20

      • C:\setflag.exe

        Filesize

        32KB

        MD5

        a4f9be8517afb4c5d9c63960a5faf258

        SHA1

        6d3300bfc43b191819f687df91bfbe2c6294d6bb

        SHA256

        78b6db289832df709d17fd5c49359ddfb9cacaa8303cd77290427bac4c829ba2

        SHA512

        c6c918bc91ed645553245cc640ed66882af264035732b8a8c2682f14a9c8f183c38837c1b3e62ca7d16e1560e6bc2a4273b41c9614a046752928c9a0c45ecb2e

      • \??\c:\cab.cab

        Filesize

        70KB

        MD5

        5a876443f36ca54efae1c723041435c0

        SHA1

        7ebd6188c3df725008209b7d24f914b2b3ce0a6c

        SHA256

        02397a86f99f98f212adee047d25c56fa6644a3cf6058ddb0da0221d708f1ee9

        SHA512

        a065a1ed747b8348c49c909e7186da584a3f01bca4652b154d5f7f88c4de15c5f0c03884db5cf33bca9035944cf5c7bc6983571301dd0fa4d7c298942887a149

      • \??\c:\internet.exe

        Filesize

        24KB

        MD5

        072ca9f791665febeacda1be1e71a124

        SHA1

        20d6d75ef7e06c72b43a2e3be81f5ceab11a1a5a

        SHA256

        692bfa3ca595a0ed57dd1d5fa6652332162c90ea0c9b8c9b32ddbebbec063f3d

        SHA512

        3cd1c0727085dcc054b1c9111c934fef3473d57a91e1e247418a220e35c59e495282740621d6c9c01c86a39ad4e5c79d7d95dbd289e25f044cfad1f616d52290

      • \??\c:\norma1.xlm

        Filesize

        68KB

        MD5

        3f08a7010fe4ea32b210b7919448ada6

        SHA1

        c7bc3bb8f78ef217b83c593542b5c4cf602746a2

        SHA256

        506260a97f723ce79e3243b651dc8af1c3fcdbf72431be60b1a0afbab8d2dce9

        SHA512

        be8ac3dcb6574e6876c2f8d2e40c1c6ad75ca611275ccc73c7283f6b17f3956c16c14d9dfa10e36576011baa691378a8ce6115e380b821a2d6f549ea46567b4c

      • \??\c:\normal.dot

        Filesize

        103KB

        MD5

        26ab77fe4d542805e0afdc9d0efc92c2

        SHA1

        332dc776b13e8f04809a312183ef9532ea2b18d3

        SHA256

        1cb2d969e56664ddc1f496c63e424cbe1ce2f560f8350f4ffa451f0fc03006d9

        SHA512

        ef439dbbe390eb175bd9970d76827a6b506b88a4db7cda233d8b6591b22e3c7a454cbb8111ca78dbbd6b195c91aa89c7d0c9df952052d3471eb07ac80f98b89a

      • memory/1676-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1676-7-0x0000000007D40000-0x0000000007F40000-memory.dmp

        Filesize

        2.0MB

      • memory/1676-1-0x000000007265D000-0x0000000072668000-memory.dmp

        Filesize

        44KB

      • memory/1676-74-0x000000007265D000-0x0000000072668000-memory.dmp

        Filesize

        44KB

      • memory/1676-75-0x0000000007D40000-0x0000000007F40000-memory.dmp

        Filesize

        2.0MB

      • memory/1676-77-0x000000007265D000-0x0000000072668000-memory.dmp

        Filesize

        44KB

      • memory/2876-29-0x000000007265D000-0x0000000072668000-memory.dmp

        Filesize

        44KB

      • memory/2876-27-0x000000002FA81000-0x000000002FA82000-memory.dmp

        Filesize

        4KB

      • memory/2876-53-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/2876-58-0x000000007265D000-0x0000000072668000-memory.dmp

        Filesize

        44KB