b54b581b34dc387949ed8c6502bfe4a435aa17288cd4a5563339e7966a51c7eb

General

Target

b54b581b34dc387949ed8c6502bfe4a435aa17288cd4a5563339e7966a51c7eb.xls
Size

49KB
MD5

9b4517dc8875fab1adea22996481d64e
SHA1

6c548121d56a13cca9785aa0044a1d4e411c3a96
SHA256

b54b581b34dc387949ed8c6502bfe4a435aa17288cd4a5563339e7966a51c7eb
SHA512

355678b9814f83004d92a014f32b6b7d2367c70447425f7a81fa622a06d661a28e1bc6679e7e0d0310aafdfe042083a526f6e31b76be8cf249acf302471d5af0
SSDEEP

768:uXyBP06LlsmK0+eq1EYR6B1iVE5VYKL6:uX686KmK0+eq141iVE5aKL

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEEXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEWINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

EXCEL.EXEWINWORD.EXE

pid process

4320 EXCEL.EXE
744 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WINWORD.EXE

description pid process

Token: SeAuditPrivilege 744 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

4320 EXCEL.EXE
4320 EXCEL.EXE

description	pid	process
Token: SeAuditPrivilege	744	WINWORD.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXEWINWORD.EXE

pid	process
4320	EXCEL.EXE
4320	EXCEL.EXE
4320	EXCEL.EXE
4320	EXCEL.EXE
4320	EXCEL.EXE
4320	EXCEL.EXE
4320	EXCEL.EXE
4320	EXCEL.EXE
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 744 wrote to memory of 1896	744	WINWORD.EXE	splwow64.exe
PID 744 wrote to memory of 1896	744	WINWORD.EXE	splwow64.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b54b581b34dc387949ed8c6502bfe4a435aa17288cd4a5563339e7966a51c7eb.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4320

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\916B4DF5-BAA2-4A14-9912-567C8B726199
Filesize
160KB

MD5
05911c38d2627b3f4b88f6a56fad084e

SHA1
ba80fc04d118439301c31bfe4bc167696ecc681a

SHA256
dec5d59b80364edf1519e509546ec06a9bff47e8fed30f6ed1cc0628f56367ea

SHA512
7d2e07a96eb864e937f6b322410514aa69d797fcca6113ec2184ba9cff50d8faab54e434bc03a44afc870de5d733e19f43ac6d2f4e04a65bf09c70a390997688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Filesize
2KB

MD5
63ac79965313b6114e620ede8f4c53fa

SHA1
c83ecffcf2b26371f8bea8282784e73589e2da0e

SHA256
dec33145babe7f61e7bd3aca45380d4a00f2ab5282a06282089d789941445354

SHA512
14324847661f98f944129998574c82443e6a96a6b3b621ad9a34a8a9653ba16b3af348a34e87c861ff2439c259987e7bea5da6e790a4a479240a704fe71f99e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Filesize
2KB

MD5
fc05eabb20a7b0d29a49977eef61f077

SHA1
d26a7cad661604dfb3878e6f4fb4b86a5118739f

SHA256
de9cc11c05faf929ac9998f0a248edb7f3de5b45ea9f6571e0604b9837d67b5a

SHA512
78d37f822fd7aea0a414bcad3749e8c7f0ec5e3f0bf75618bea994c77fbfe5efe503952ec80a22c60f616338bf002d82fb612302374c5f0db05f64da9a108c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TMWGKKVJ\europinvisitedmetokissherlipswithentireheartbeartbecauseits%20verysweethearttandloveyoutruly___iwannakissyoulipswithfrenchlov[1].doc
Filesize
61KB

MD5
6d60ba52e8815270edec9be06598b966

SHA1
12708a12657b56b766902dd7638eb6ae4d4412b6

SHA256
81b9c1588fb5da83623d2d10a00f34209540c54685ef566332cabdd201cb91ef

SHA512
0368df58000772e5709af9132b1b6e70c3bafdce1ebf17a57b975a6923035848cf5e914f8f3000327c3cd5358722300d7be5c9010be2cc1d17ba511eee27137a

Download Submit
memory/744-42-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-37-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-128-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-43-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-73-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-72-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-51-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-50-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-49-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-47-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-46-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-45-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-44-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-40-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-38-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-33-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/744-36-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-7-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-4-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-17-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-14-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-5-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-16-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-15-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-0-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download
memory/4320-13-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-12-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-11-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-10-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-3-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download
memory/4320-18-0x00007FFD31390000-0x00007FFD313A0000-memory.dmp

Filesize
64KB

Download
memory/4320-2-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download
memory/4320-1-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download
memory/4320-71-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-9-0x00007FFD31390000-0x00007FFD313A0000-memory.dmp

Filesize
64KB

Download
memory/4320-8-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-119-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download
memory/4320-117-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download
memory/4320-122-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download
memory/4320-121-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download
memory/4320-124-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-127-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-126-0x00007FFD73BD0000-0x00007FFD73DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4320-6-0x00007FFD33C50000-0x00007FFD33C60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads