Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 19:20
Behavioral task
behavioral1
Sample
PaymentStatus.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PaymentStatus.xls
Resource
win10v2004-20240802-en
General
-
Target
PaymentStatus.xls
-
Size
216KB
-
MD5
2486374800299563ab8934122234242a
-
SHA1
47bfe94aa96ef43231890f04ccd286b0888e10c8
-
SHA256
ef2ce641a4e9f270eea626e8e4800b0b97b4a436c40e7af30aeb6f02566b809c
-
SHA512
74e52e1e1317908447340cbba32949321ed435f17a524224af80236ecdf67187c83908cca514e82a49b9abe9495125ba741e01ed8f30663124c13fce339c63e5
-
SSDEEP
6144:bKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgAyY+TAQXTHGUMEyP5p6f5jQmK:GbGUMVWlbK
Malware Config
Extracted
https://audioselec.com/about/dDw5ggtyMojggTqhc/
https://geringer-muehle.de/wp-admin/G/
http://intolove.co.uk/wp-admin/FbGhiWtrEzrQ/
http://isc.net.ua/themes/3rU/
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2796 2296 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2120 2296 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2816 2296 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2884 2296 regsvr32.exe EXCEL.EXE -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeEXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2296 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 2296 EXCEL.EXE 2296 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2296 wrote to memory of 2796 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2796 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2796 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2796 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2796 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2796 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2796 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2120 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2120 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2120 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2120 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2120 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2120 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2120 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2816 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2816 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2816 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2816 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2816 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2816 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2816 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2884 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2884 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2884 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2884 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2884 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2884 2296 EXCEL.EXE regsvr32.exe PID 2296 wrote to memory of 2884 2296 EXCEL.EXE regsvr32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PaymentStatus.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2884