d9ca838e9352c39cbbc3d4372191a36bfaf4152efa4897eb5ad5560b307554f7

General

Target

d9ca838e9352c39cbbc3d4372191a36bfaf4152efa4897eb5ad5560b307554f7.xls
Size

91KB
MD5

1efb8fac2a81a1de15baf049e2380353
SHA1

f61f1490d9f6bf233efb47bedc5b72986971e3ff
SHA256

d9ca838e9352c39cbbc3d4372191a36bfaf4152efa4897eb5ad5560b307554f7
SHA512

f7f03f635c3fc0117637bfd65f13a3c6e1728b82e9d60dbd6cdb9ab2776e5681df641ed7232f3fcf1c3f877eeb822d644be3a05600ae210e79f71c4e9ccb2290
SSDEEP

1536:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgqbCXuZH4gb4CEn9J4ZXz3:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgO

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.conceptagency.net/css/b8eaKN/

xlm40.dropper

https://bencevendeghaz.hu/2zjoi/cwfKJOzA/

xlm40.dropper

http://45.32.114.141/xilte/Uqm6Eysf3Hkjwh/

xlm40.dropper

http://ruitaiwz.com/wp-admin/MXlp5IsUKwT1k0DtzT/

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	552	2992	regsvr32.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1232	2992	regsvr32.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4700	2992	regsvr32.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3380	2992	regsvr32.exe	82

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2992	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2992	EXCEL.EXE
2992	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE
2992	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 552	2992	EXCEL.EXE	87
PID 2992 wrote to memory of 552	2992	EXCEL.EXE	87
PID 2992 wrote to memory of 1232	2992	EXCEL.EXE	94
PID 2992 wrote to memory of 1232	2992	EXCEL.EXE	94
PID 2992 wrote to memory of 4700	2992	EXCEL.EXE	95
PID 2992 wrote to memory of 4700	2992	EXCEL.EXE	95
PID 2992 wrote to memory of 3380	2992	EXCEL.EXE	98
PID 2992 wrote to memory of 3380	2992	EXCEL.EXE	98

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d9ca838e9352c39cbbc3d4372191a36bfaf4152efa4897eb5ad5560b307554f7.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:552
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:1232
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:4700
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
e68bc3f628f8460336c043b59f9c9df0

SHA1
854b871b2d697e5365e26a1ac94998a8a078e19b

SHA256
cf4b441927dd7e49b736b24c7c22f6b811f4f5d0c4ecf77a0241d5d7748c35cc

SHA512
54fe3b344364e1b910d336a3f5f2cd221a5e8ade0e4eebd600308f125876d334e1a5ef1da7855511f3dc408bd68b4e080df631212913d06858dc184502b56d04

Download Submit
C:\Users\Admin\elv2.ooocccxxx

Filesize
26B

MD5
a413a6b0b4dd25a2a341cf13becce672

SHA1
5c18a31678ccb7d09ada7242a6d4ed6164b2ebac

SHA256
2e2f8ccc18ba3718965719e20d1f561c7a872a1ea50214ad3ba0ed0fe5fd19e3

SHA512
aa70031875406f0f167f995097ca6116ffeaea941aeabc88a2e136f22d81402b7aea510bcd0846d0b3bae949830210c8f731cc98d8d4b0cdb12be7eaa01b81e9

Download Submit
C:\Users\Admin\elv4.ooocccxxx

Filesize
1KB

MD5
76d9c6ef125731fcdb6a6688cd7f8ce8

SHA1
21252e8bffb7dd28135bb85b666f1aea4d02f05f

SHA256
840e65d3e2051b29215fcc0d39dfe347f2477794f5bdc5f42b53cb4169627f1f

SHA512
6a977dd2b9a4eaac568b25c278f1a4032f0f64001d64cc245bd8b5e9ded0c46d0a6f562482f7a8454d2138ce2edee76dd8860f09038c3caec366f031970e8084

Download Submit
memory/2992-9-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-11-0x00007FFC27230000-0x00007FFC27240000-memory.dmp

Filesize
64KB

Download
memory/2992-5-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-6-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-7-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/2992-8-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-10-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-1-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/2992-12-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-0-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/2992-13-0x00007FFC27230000-0x00007FFC27240000-memory.dmp

Filesize
64KB

Download
memory/2992-14-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-15-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-18-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-17-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-16-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-4-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/2992-52-0x00007FFC694B0000-0x00007FFC696A5000-memory.dmp

Filesize
2.0MB

Download
memory/2992-2-0x00007FFC29530000-0x00007FFC29540000-memory.dmp

Filesize
64KB

Download
memory/2992-3-0x00007FFC6954D000-0x00007FFC6954E000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads