d2358b1fe7fbcfcedfa94ee300be948b89c84ed05269eee70efd4115e7f9274a

Analysis

max time kernel
138s
max time network
138s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-02_9151304fd592a70cbbc69c4b14f5d446_mafia.exe
Size 11.2MB
Sample240502-zktjcafc21
SHA256 d2358b1fe7fbcfcedfa94ee300be948b89c84ed05269eee70efd4115e7f9274a
MD5 9151304fd592a70cbbc69c4b14f5d446
SHA1 4607f5a2a314d6f04d2ef406fc534b0101849707
SHA512 b80820d7345076dd5796a11731d93d7d39297e359bc3eb6038f0998702d1119c61abf87551e7704ff52f0da4fa8c69444edde4d965582bde0c35d912c5d6505c
SSDEEP 196608:jeYmgL4qfMEYhPIkJiEBjviR/5mrB3+361SQCTbURRPs6VP60l5q3aGANTbU3:jeYVL5QPIFEBg5mrBu361SXAK6VP60bo
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

macro

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 10 IoCs

resource	yara_rule
behavioral1/memory/2568-93-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-91-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-98-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-97-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-94-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-92-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-90-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-89-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-88-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2568-87-0x00000000758D0000-0x0000000075AE5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0007000000015d85-11.dat

Loads dropped DLL 1 IoCs

pid	Process
2568	EXCEL.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2024-05-02_9151304fd592a70cbbc69c4b14f5d446_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	2024-05-02_9151304fd592a70cbbc69c4b14f5d446_mafia.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CFD0002-7E2C-4F31-9847-1D9A54B93329}\2.0\0\win32	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CFD0002-7E2C-4F31-9847-1D9A54B93329}\2.0	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CFD0002-7E2C-4F31-9847-1D9A54B93329}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Excel8.0\\MSForms.exd"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2568	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2568	EXCEL.EXE
2568	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	EXCEL.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2568	EXCEL.EXE
2568	EXCEL.EXE
2568	EXCEL.EXE
2568	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\2024-05-02_9151304fd592a70cbbc69c4b14f5d446_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_9151304fd592a70cbbc69c4b14f5d446_mafia.exe"
1⤵
- Checks processor information in registry
PID:2644

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LockXLSRuntime.dll

Path C:\Users\Admin\AppData\Local\SpreadsheetTools\32\LockXLSRuntime.dll
Size 1.4MB
SHA256 f72667f03aca4b5be6505698976130b0fe5f7a571d8972f6f6703e5b0adeb852
MD5 9025382881a3aef5aa474fc23b188c7e
SHA1 a30f2a518a0ba97da7851524f9bcdec47d2112d0
SHA512 f640423807ce86b898980180eab6c487a35569abf1a1f2f68ac31e33b4c05310fe006b77530316f5b4a1ddf6bee65909fc661ece827f97ac21947e6eeedc6bc3
SSDEEP 24576:hPCPKvzZupdhJJYA7wc8R8jV7koN5AHzRs4nBdKU6w6n9:hP7VuHJYA7sR8JVmHz1nBdKDHn9
MD5 SHA1 SHA512 SSDEEP

Submit Download

empty.xls

Path C:\Users\Admin\AppData\Local\SpreadsheetTools\empty.xls
Size 22KB
SHA256 69a5e9e187a777a31f7bcb025f63fb5316ca4df3e017d52092703f626e1b1c90
MD5 545b33a6402a128bc4d7666df213494c
SHA1 2f30af27df447da4bab9fa037f758ff539a06539
SHA512 fa45ad8d9cbee0b1bfe7bd0b573e5de4a6ed549050cc662487b1ca7f0f5d91ae16075eda670327e060732932f86414d13fcf086dae2fb551eccd46c31ada0c18
SSDEEP 384:oI2ET5xEtjPOtiLkVyoDGUU1qfDlaGGxTqcLrKQzrAps9BXBrBG4:oqlxEtjPOtioVjDGUU1qfDlaGGx+cL28
MD5 SHA1 SHA512 SSDEEP

Submit Download

lxLdr.xlam

Path C:\Users\Admin\AppData\Local\SpreadsheetTools\lxLdr.xlam
Size 20KB
SHA256 bb270b26d2fa3a11267047527470c7601420e52f31be91ada0abac22f9cddac3
MD5 635b36337367017cadbbfa5577b35a5e
SHA1 870f04837b583204d25157659c6232fc94af328c
SHA512 69c8645ea65ee7f257df8b399c52e4bcb77f73f36d70132b7c3b32648b3d16cdb7991688a3a745070288886bb9a0150a1849d40173924b0bdeed990c048b65ea
SSDEEP 384:NIomHABP+YuxHP0n2xJswxhE5kb627y0eMPIDqxKfv/:NIomgBP+YucyJswxakbtve6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2568-8-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2568-9-0x0000000072C8D000-0x0000000072C98000-memory.dmp

Download

memory/2568-64-0x0000000005550000-0x0000000005650000-memory.dmp

Download

memory/2568-65-0x0000000005550000-0x0000000005650000-memory.dmp

Download

memory/2568-68-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-82-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-85-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-86-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-84-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-83-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-93-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-91-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-81-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-80-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-79-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-78-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-77-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-74-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-73-0x000000006D260000-0x000000006D4ED000-memory.dmp

Download

memory/2568-72-0x000000006D260000-0x000000006D4ED000-memory.dmp

Download

memory/2568-71-0x000000006D260000-0x000000006D4ED000-memory.dmp

Download

memory/2568-70-0x000000006CE40000-0x000000006CFAA000-memory.dmp

Download

memory/2568-76-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-75-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-69-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-67-0x00000000773C0000-0x000000007751C000-memory.dmp

Download

memory/2568-155-0x0000000005550000-0x0000000005650000-memory.dmp

Download

memory/2568-138-0x0000000005550000-0x0000000005650000-memory.dmp

Download

memory/2568-99-0x0000000005550000-0x0000000005650000-memory.dmp

Download

memory/2568-98-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-97-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-94-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-92-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-90-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-89-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-88-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-87-0x00000000758D0000-0x0000000075AE5000-memory.dmp

Download

memory/2568-159-0x000000006CD00000-0x000000006CE33000-memory.dmp

Download

memory/2568-158-0x000000006CD00000-0x000000006CE33000-memory.dmp

Download

memory/2568-157-0x000000006CD00000-0x000000006CE33000-memory.dmp

Download

memory/2568-156-0x000000006CD00000-0x000000006CE33000-memory.dmp

Download

memory/2568-161-0x000000006CBB0000-0x000000006CBC8000-memory.dmp

Download

memory/2568-160-0x000000006CBB0000-0x000000006CBC8000-memory.dmp

Download

memory/2568-211-0x000000006C9F0000-0x000000006CB1C000-memory.dmp

Download

memory/2568-212-0x000000006C9F0000-0x000000006CB1C000-memory.dmp

Download

memory/2568-213-0x000000006C9F0000-0x000000006CB1C000-memory.dmp

Download

memory/2568-244-0x000000006C950000-0x000000006C97E000-memory.dmp

Download

memory/2568-243-0x000000006C950000-0x000000006C97E000-memory.dmp

Download

memory/2568-247-0x0000000072C8D000-0x0000000072C98000-memory.dmp

Download

memory/2568-248-0x0000000005550000-0x0000000005650000-memory.dmp

Download

memory/2568-386-0x0000000075240000-0x0000000075298000-memory.dmp

Download

memory/2568-387-0x0000000075240000-0x0000000075298000-memory.dmp

Download

memory/2568-391-0x0000000076FE0000-0x00000000771A4000-memory.dmp

Download

memory/2568-390-0x000000006C8A0000-0x000000006C8FA000-memory.dmp

Download

memory/2568-389-0x000000006C8A0000-0x000000006C8FA000-memory.dmp

Download

memory/2568-388-0x000000006C8A0000-0x000000006C8FA000-memory.dmp

Download

memory/2568-384-0x0000000076FE0000-0x00000000771A4000-memory.dmp

Download

memory/2568-383-0x0000000076FE0000-0x00000000771A4000-memory.dmp

Download

memory/2568-382-0x0000000076FE0000-0x00000000771A4000-memory.dmp

Download

memory/2568-381-0x0000000076FE0000-0x00000000771A4000-memory.dmp

Download

memory/2568-380-0x0000000076CF0000-0x0000000076E14000-memory.dmp

Download

memory/2568-379-0x0000000076CF0000-0x0000000076E14000-memory.dmp

Download

memory/2568-377-0x0000000076CF0000-0x0000000076E14000-memory.dmp

Download

memory/2568-385-0x0000000075240000-0x0000000075298000-memory.dmp

Download

memory/2568-378-0x0000000076CF0000-0x0000000076E14000-memory.dmp

Download

memory/2568-478-0x0000000005550000-0x0000000005650000-memory.dmp

Download

memory/2568-477-0x0000000072C8D000-0x0000000072C98000-memory.dmp

Download