1719d0c5f71e7f50016ecc57404701253b5ba62f3e433e814ebd1d1392aa3bf7

General

Target

1719d0c5f71e7f50016ecc57404701253b5ba62f3e433e814ebd1d1392aa3bf7.xlsm
Size

95KB
MD5

8f6a221921d7304c36d4df1d10590e0e
SHA1

76d4fb2c73e2cacc48d04d972adab7628cc6f9e2
SHA256

1719d0c5f71e7f50016ecc57404701253b5ba62f3e433e814ebd1d1392aa3bf7
SHA512

a8396360a5f20125c0b7e25d8a41abadd059f55c86d45ee601273fd3fad78c8327a121835f79edf05c20680061cadf8ebff5adbd66da7f550133115edaba402e
SSDEEP

1536:sQxfGWXG8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVFfw:s2318DsVhonV69o2bchgGaWBcpA+fw

Score

10^/10

discovery

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://ashirvadgroup.com/wp-admin/LtoH5AWneDBZIV2D/

xlm40.dropper

https://patriciamirapsicologa.com/wp-includes/fVVa9DXB/

xlm40.dropper

https://forfreeiptv.com/wp-admin/s5Oxoskqv8/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1636	116	regsvr32.exe	EXCEL.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

116 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

116 EXCEL.EXE
116 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE
116	EXCEL.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 116 wrote to memory of 1636	116	EXCEL.EXE	regsvr32.exe
PID 116 wrote to memory of 1636	116	EXCEL.EXE	regsvr32.exe
PID 116 wrote to memory of 1636	116	EXCEL.EXE	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1719d0c5f71e7f50016ecc57404701253b5ba62f3e433e814ebd1d1392aa3bf7.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWow64\regsvr32.exe
  C:\Windows\SysWow64\regsvr32.exe /s ..\dw1.ocx
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
29aae3ca5fca2440c32146e9e327fa15

SHA1
3c3a023d29d1a2f42d14f111033d8dec7130b48a

SHA256
8fb2a0a11b7bbe9929466645e6bba51df76d981e3a9b9c1c4aeb613167ce243c

SHA512
79256aa83a4815389023aae3985d31055dc2effcedb983844af1b1d3e777c51730ef6160510fe66acaa240f7608d71e6d92375554fe464cc14c809bb376aca7c

Download Submit
C:\Users\Admin\dw1.ocx

Filesize
497B

MD5
149bd4f3a0bf4746860699909bf267f6

SHA1
d48033a4185bb8fcdec8f11d2c5fae96b94806e3

SHA256
c0784f2fef1d4b0cbcb7c1348e6cc09c72924e1168c69a665e3d519e2525cb38

SHA512
6d531d80729779449ce29f9dcc91660cfde794b011186c90eb06b9da0e9b143f1dcc2ae84fbc91c2a6f4e76b62f415dcdba0d7dd56dc62b3aa60ec9cd73b836c

Download Submit
memory/116-15-0x00007FFC0A200000-0x00007FFC0A210000-memory.dmp

Filesize
64KB

Download
memory/116-0-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

Filesize
64KB

Download
memory/116-1-0x00007FFC4C48D000-0x00007FFC4C48E000-memory.dmp

Filesize
4KB

Download
memory/116-7-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-6-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-10-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-14-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-16-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-17-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-13-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-5-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

Filesize
64KB

Download
memory/116-2-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

Filesize
64KB

Download
memory/116-18-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-12-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-11-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-9-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-8-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

Filesize
64KB

Download
memory/116-4-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-3-0x00007FFC0C470000-0x00007FFC0C480000-memory.dmp

Filesize
64KB

Download
memory/116-43-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-44-0x00007FFC4C48D000-0x00007FFC4C48E000-memory.dmp

Filesize
4KB

Download
memory/116-45-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/116-19-0x00007FFC0A200000-0x00007FFC0A210000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads