Analysis
-
max time kernel
60s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 13:09
Behavioral task
behavioral1
Sample
Payment Status.xls
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Payment Status.xls
Resource
win10v2004-20240802-en
General
-
Target
Payment Status.xls
-
Size
216KB
-
MD5
2486374800299563ab8934122234242a
-
SHA1
47bfe94aa96ef43231890f04ccd286b0888e10c8
-
SHA256
ef2ce641a4e9f270eea626e8e4800b0b97b4a436c40e7af30aeb6f02566b809c
-
SHA512
74e52e1e1317908447340cbba32949321ed435f17a524224af80236ecdf67187c83908cca514e82a49b9abe9495125ba741e01ed8f30663124c13fce339c63e5
-
SSDEEP
6144:bKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgAyY+TAQXTHGUMEyP5p6f5jQmK:GbGUMVWlbK
Malware Config
Extracted
https://audioselec.com/about/dDw5ggtyMojggTqhc/
https://geringer-muehle.de/wp-admin/G/
http://intolove.co.uk/wp-admin/FbGhiWtrEzrQ/
http://isc.net.ua/themes/3rU/
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2600 2300 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2812 2300 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2880 2300 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2604 2300 regsvr32.exe EXCEL.EXE -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2300 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 2300 EXCEL.EXE 2300 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 2300 EXCEL.EXE 2300 EXCEL.EXE 2300 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2300 wrote to memory of 2600 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2600 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2600 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2600 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2600 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2600 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2600 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2812 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2812 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2812 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2812 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2812 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2812 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2812 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2880 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2880 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2880 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2880 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2880 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2880 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2880 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2604 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2604 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2604 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2604 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2604 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2604 2300 EXCEL.EXE regsvr32.exe PID 2300 wrote to memory of 2604 2300 EXCEL.EXE regsvr32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Status.xls"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2604