Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2024 07:08

General

  • Target

    中小学名单/2012城市小学.xls

  • Size

    137KB

  • MD5

    441ee7b24964ea16bc493ba8d16cfcc3

  • SHA1

    494430055b382c317a2de645f02433c730642f88

  • SHA256

    0a0e20688b031efbaad3dcae47a6419065312914c7fab1e2355074cbef891078

  • SHA512

    7e8351aeaa01e2a26df1223a9598a3e15bdf790318cad304e20f0b96954cc4e3d6f6baed0b80332c16999cbb3578c347aff9761b9aa0390e681d4a81ac2e9e32

  • SSDEEP

    1536:fllllJhrYqGu/fgPrMsl/HORPN/Z95qWBco7W0ZF3XAyRmhVY0WVbrzQ7ITkC1xY:l5hW0ZFl0PWVbrzQ7ITkvxU0JtXwslP

Malware Config

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes itself 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\中小学名单\2012城市小学.xls
    1⤵
    • Deletes itself
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Windows\SysWOW64\attrib.exe
        attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1764
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:1820
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1292-1-0x00000000721AD000-0x00000000721B8000-memory.dmp

    Filesize

    44KB

  • memory/1292-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1292-2-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-10-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-14-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-17-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-4-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-3-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-5-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-6-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-25-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-7-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-28-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-19-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-30-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-31-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-29-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-27-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-26-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-24-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-23-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-22-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-21-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-20-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-18-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-16-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-15-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-13-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-12-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-11-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-9-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-8-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-32-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-95-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-68-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-330-0x00000000721AD000-0x00000000721B8000-memory.dmp

    Filesize

    44KB

  • memory/1292-331-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-332-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-333-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-334-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1292-338-0x00000000721AD000-0x00000000721B8000-memory.dmp

    Filesize

    44KB