f663c3bff1ac1034269ea51d5f01f982773e6e40ae397d8fb6c0fa4ae627181b

General

Target

County Payment Report - 2022-11-10_1226.xls
Size

91KB
MD5

7c517fc0f713609f740d375ecfb33108
SHA1

736006fb5cc695be518b49bacc128bad5888e272
SHA256

3959e0f2ce9b4b6976ec5f51d95aa661c26000878daecf0e68803145d9f70b40
SHA512

0bbcf46e0b70e05f28994c1993f0ad7ceecc7c21a52587426adc569b7cb54d40408d85efc6ee2d3de97a3b6f1b71cedd899a5b80c64fe004f8355bfc15af70dc
SSDEEP

1536:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4bCXuZH4gb4CEn9J4ZjrX:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgs

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.vinyz.com/cache/rqWV/

xlm40.dropper

http://yuanliao.raluking.com/1eq5o7/gHrTM8YilZz0quKt/

xlm40.dropper

https://akarweb.net/cgi-bin/CL13tGXI/

xlm40.dropper

http://www.bdbg.es/css/DDm7o71vWtTs/

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3820	1524	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4500	1524	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4988	1524	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1260	1524	regsvr32.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1524 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

1524 EXCEL.EXE
1524 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE
1524	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 1524 wrote to memory of 3820	1524	EXCEL.EXE	regsvr32.exe
PID 1524 wrote to memory of 3820	1524	EXCEL.EXE	regsvr32.exe
PID 1524 wrote to memory of 4500	1524	EXCEL.EXE	regsvr32.exe
PID 1524 wrote to memory of 4500	1524	EXCEL.EXE	regsvr32.exe
PID 1524 wrote to memory of 4988	1524	EXCEL.EXE	regsvr32.exe
PID 1524 wrote to memory of 4988	1524	EXCEL.EXE	regsvr32.exe
PID 1524 wrote to memory of 1260	1524	EXCEL.EXE	regsvr32.exe
PID 1524 wrote to memory of 1260	1524	EXCEL.EXE	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\County Payment Report - 2022-11-10_1226.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:3820
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:4500
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:4988
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
5f835f0ba308ce476a3fa892b705e0b9

SHA1
c277d610352b3ae6a40848a113b0cce827b1c20b

SHA256
6aea88f516840e958d9ecd1ea53a48963bb12d1e776aab2a5c6654cf8b7c7892

SHA512
9a563327cd11ecef67006bc18cbb0e9c19ef3f54650d53cba2b26a9029296ff0564974aefbd79bcd9de36734aa3df9035e7874e52ce007b914122defd3811569

Download Submit
memory/1524-9-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download
memory/1524-2-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

Filesize
64KB

Download
memory/1524-14-0x00007FFC7A4F0000-0x00007FFC7A500000-memory.dmp

Filesize
64KB

Download
memory/1524-13-0x00007FFC7A4F0000-0x00007FFC7A500000-memory.dmp

Filesize
64KB

Download
memory/1524-5-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download
memory/1524-6-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download
memory/1524-7-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

Filesize
64KB

Download
memory/1524-0-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

Filesize
64KB

Download
memory/1524-1-0x00007FFCBCC0D000-0x00007FFCBCC0E000-memory.dmp

Filesize
4KB

Download
memory/1524-3-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

Filesize
64KB

Download
memory/1524-4-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

Filesize
64KB

Download
memory/1524-12-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download
memory/1524-11-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download
memory/1524-10-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download
memory/1524-30-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download
memory/1524-31-0x00007FFCBCC0D000-0x00007FFCBCC0E000-memory.dmp

Filesize
4KB

Download
memory/1524-32-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download
memory/1524-8-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads