Analysis
-
max time kernel
133s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 21:31
Behavioral task
behavioral1
Sample
ba3d443673d9b9b96d6f9d52a19b9a756e300815f1f2af79128cece16a481c25.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ba3d443673d9b9b96d6f9d52a19b9a756e300815f1f2af79128cece16a481c25.xls
Resource
win10v2004-20241007-en
General
-
Target
ba3d443673d9b9b96d6f9d52a19b9a756e300815f1f2af79128cece16a481c25.xls
-
Size
77KB
-
MD5
f7e9453bd7977b415e9020587e4fa6df
-
SHA1
548442780602838cec644b46497b5bdedd38067c
-
SHA256
ba3d443673d9b9b96d6f9d52a19b9a756e300815f1f2af79128cece16a481c25
-
SHA512
1a46c3ba1786ca4024b5515902c058ee64f30ca6595431dc0897e05a31fcafc88a7e65b10e7ef2a197c8cf9fd289d8004f71a0adf20f38dec01638f4aa45ba64
-
SSDEEP
1536:ASKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgew+hD8nTLqQrRrZws8E6u:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5
Malware Config
Extracted
http://natdemo.natrixsoftware.com/wp-admin/QyqiN/
http://luisangeja.com/COPYRIGHT/BJljffG6/
http://nerz.net/stats/KVIyooM/
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1036 2452 regsvr32.exe 83 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1416 2452 regsvr32.exe 83 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1908 2452 regsvr32.exe 83 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2452 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2452 EXCEL.EXE 2452 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE 2452 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2452 wrote to memory of 1036 2452 EXCEL.EXE 87 PID 2452 wrote to memory of 1036 2452 EXCEL.EXE 87 PID 2452 wrote to memory of 1416 2452 EXCEL.EXE 88 PID 2452 wrote to memory of 1416 2452 EXCEL.EXE 88 PID 2452 wrote to memory of 1908 2452 EXCEL.EXE 89 PID 2452 wrote to memory of 1908 2452 EXCEL.EXE 89
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ba3d443673d9b9b96d6f9d52a19b9a756e300815f1f2af79128cece16a481c25.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 C:\Uduw\soam1.OCX2⤵
- Process spawned unexpected child process
PID:1036
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 C:\Uduw\soam2.OCX2⤵
- Process spawned unexpected child process
PID:1416
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 C:\Uduw\soam3.OCX2⤵
- Process spawned unexpected child process
PID:1908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD59429f22bee14bc774ca286043ca6b95d
SHA13b3e1d2143b3f59bec0101a49988a73b357762ba
SHA2569cd6ab6a70727eb5d771785b85b75f32c1725808a01d02bc98ac7ebe8f5b9187
SHA512571009186dead41255d7e1f898fa9a04e7b3de57afbd6a71087299562b727d9f10187f53b42076e708feba60a355d40305f1cb01592f8116ac0997b1a18fe2e2