3102c50fddd6bbc1e5c8e90f91fb984327f0bdb71343c4febc1b07d62351bcfe

General

Target

3102c50fddd6bbc1e5c8e90f91fb984327f0bdb71343c4febc1b07d62351bcfe.xls
Size

95KB
MD5

18ccf9783c4ce2ac723bfe40459e29ef
SHA1

9b55316fb9e9e46bb55eca462c1d862dceb6a97f
SHA256

3102c50fddd6bbc1e5c8e90f91fb984327f0bdb71343c4febc1b07d62351bcfe
SHA512

055f2cc3961597a051e719473ad1592451235fa11a4179db5113eed7f11d36f8e35c2b97ca50851f2be2178f5af0bb2b8e36b37597125847933fc3de39c00f01
SSDEEP

1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgNHuS4hcTO97v7UYdEJmt:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgQ

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://fikti.bem.gunadarma.ac.id/SDM/YH8OJ1Zz8miBX/

xlm40.dropper

http://ebuysa.co.za/yt-assets/yZ30/

xlm40.dropper

http://3dstudioa.com.br/files/1ubPAB/

xlm40.dropper

http://boardmart.co.za/images/DvMHPbTLn/

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1252	3628	regsvr32.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1900	3628	regsvr32.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2628	3628	regsvr32.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1932	3628	regsvr32.exe	82

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3628	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3628	EXCEL.EXE
3628	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE
3628	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 1252	3628	EXCEL.EXE	90
PID 3628 wrote to memory of 1252	3628	EXCEL.EXE	90
PID 3628 wrote to memory of 1900	3628	EXCEL.EXE	94
PID 3628 wrote to memory of 1900	3628	EXCEL.EXE	94
PID 3628 wrote to memory of 2628	3628	EXCEL.EXE	97
PID 3628 wrote to memory of 2628	3628	EXCEL.EXE	97
PID 3628 wrote to memory of 1932	3628	EXCEL.EXE	102
PID 3628 wrote to memory of 1932	3628	EXCEL.EXE	102

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3102c50fddd6bbc1e5c8e90f91fb984327f0bdb71343c4febc1b07d62351bcfe.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\soci1.ocx
  2⤵
  - Process spawned unexpected child process
  PID:1252
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\soci2.ocx
  2⤵
  - Process spawned unexpected child process
  PID:1900
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\soci3.ocx
  2⤵
  - Process spawned unexpected child process
  PID:2628
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\soci4.ocx
  2⤵
  - Process spawned unexpected child process
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
f1a1f0ee1764cc45c7700b51d9b29564

SHA1
31c40a2e197dfc6201e3ae7488bdb102a7ffb755

SHA256
526a9398306b4437090860cbccf9d56f6cd0d7d25d1f5d3fd115bc824dd0dbfc

SHA512
349afdfed927118ce305a147cc5efee1e2e5637dc107d35531c256f692d2e1e7f6e5efa20d62fe02e8bccb8c9280c0d550db59d2192aef2d1b05902c35397392

Download Submit
memory/3628-16-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-2-0x00007FFEAF190000-0x00007FFEAF1A0000-memory.dmp

Filesize
64KB

Download
memory/3628-5-0x00007FFEAF190000-0x00007FFEAF1A0000-memory.dmp

Filesize
64KB

Download
memory/3628-8-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-12-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-11-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-10-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-13-0x00007FFEAD130000-0x00007FFEAD140000-memory.dmp

Filesize
64KB

Download
memory/3628-9-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-7-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-4-0x00007FFEAF190000-0x00007FFEAF1A0000-memory.dmp

Filesize
64KB

Download
memory/3628-3-0x00007FFEEF1AD000-0x00007FFEEF1AE000-memory.dmp

Filesize
4KB

Download
memory/3628-22-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-20-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-15-0x00007FFEAD130000-0x00007FFEAD140000-memory.dmp

Filesize
64KB

Download
memory/3628-21-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-19-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-18-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-14-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-6-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-0-0x00007FFEAF190000-0x00007FFEAF1A0000-memory.dmp

Filesize
64KB

Download
memory/3628-1-0x00007FFEAF190000-0x00007FFEAF1A0000-memory.dmp

Filesize
64KB

Download
memory/3628-42-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download
memory/3628-17-0x00007FFEEF110000-0x00007FFEEF305000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads