eec91171396a2b47a16b97c885482b21189a8d7917aa1493bfe1bff654d84a3b

General

Target

eec91171396a2b47a16b97c885482b21189a8d7917aa1493bfe1bff654d84a3b.xls
Size

91KB
MD5

34a2633ea06672b6df4627d64d308d00
SHA1

c685f4d69a617e5f2dadf6eec83c7c3f269660a4
SHA256

eec91171396a2b47a16b97c885482b21189a8d7917aa1493bfe1bff654d84a3b
SHA512

8b240343d2f5b62a026d0c871267d405e160545b14d6195b5de5630762f3d58dbc13c01517de7b87c250d3613931ea0e40519e8201f6c9c7649854b8e45c6f16
SSDEEP

1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2bCXuZH4gb4CEn9J4Zqcvp:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgi

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://bundlefilm.com/headers/lkfBH3Czw9CjEW07P2/

xlm40.dropper

http://camsanparke.net/wp-content/h2Ja5bwB03hnyfCb/

xlm40.dropper

http://royreid.co.uk/wp-content/dCwG/

xlm40.dropper

https://cs.com.sg/admin/a1lR5wu/

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1460	3880	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3480	3880	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4296	3880	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1872	3880	regsvr32.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3880 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

3880 EXCEL.EXE
3880 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE
3880	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 3880 wrote to memory of 1460	3880	EXCEL.EXE	regsvr32.exe
PID 3880 wrote to memory of 1460	3880	EXCEL.EXE	regsvr32.exe
PID 3880 wrote to memory of 3480	3880	EXCEL.EXE	regsvr32.exe
PID 3880 wrote to memory of 3480	3880	EXCEL.EXE	regsvr32.exe
PID 3880 wrote to memory of 4296	3880	EXCEL.EXE	regsvr32.exe
PID 3880 wrote to memory of 4296	3880	EXCEL.EXE	regsvr32.exe
PID 3880 wrote to memory of 1872	3880	EXCEL.EXE	regsvr32.exe
PID 3880 wrote to memory of 1872	3880	EXCEL.EXE	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eec91171396a2b47a16b97c885482b21189a8d7917aa1493bfe1bff654d84a3b.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:1460
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:3480
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:4296
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
191c23f1d7647155bcc60177748248aa

SHA1
9eff339350096ed892757be883332ff6af08139f

SHA256
5599be67398669602543a38631cf0c634ded1a82ce26b361278db5e26ca494b2

SHA512
bc85a13fbf00ce6082ca9acfc6a58347f1bae7fb82195779ae85c406f340524cb42496f6ec386058c5df6e15300f6d3c09b11aab6bdb2a6fba0a2cdd1c6c4a2d

Download Submit
memory/3880-12-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-31-0x00007FFCE634D000-0x00007FFCE634E000-memory.dmp

Filesize
4KB

Download
memory/3880-3-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/3880-6-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-7-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-8-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/3880-9-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-5-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-13-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-14-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-1-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/3880-2-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/3880-10-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-16-0x00007FFCA40B0000-0x00007FFCA40C0000-memory.dmp

Filesize
64KB

Download
memory/3880-11-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-17-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-20-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-19-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-18-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-4-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/3880-30-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-0-0x00007FFCE634D000-0x00007FFCE634E000-memory.dmp

Filesize
4KB

Download
memory/3880-32-0x00007FFCE62B0000-0x00007FFCE64A5000-memory.dmp

Filesize
2.0MB

Download
memory/3880-15-0x00007FFCA40B0000-0x00007FFCA40C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads