8c9daf3ae83f4fdebad6f09fab1fe68050b4b2b6269ddf9896e6ff8b985b66b6

General

Target

8c9daf3ae83f4fdebad6f09fab1fe68050b4b2b6269ddf9896e6ff8b985b66b6.xlsm
Size

74KB
MD5

f946db4fd30a9995db31106efcebd7aa
SHA1

9d70b3f038630359899e20a5e17c76fb9147c87d
SHA256

8c9daf3ae83f4fdebad6f09fab1fe68050b4b2b6269ddf9896e6ff8b985b66b6
SHA512

7e72dfb939c9e7c5838fd2b8ddc7ec1c93c7921f67a6201e58b7d2c06bea8265b5bc8041e3d04dea2d41c9ae483ca193367219aa487aa6a8ca0e91db2368c38c
SSDEEP

1536:SuSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsM9VIzEA:stzSmICpH7OZuvZGsMo

Score

10^/10

discovery

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://thesparklezbox.com/wp-admin/kFkWN/

xlm40.dropper

https://herbtytox.com/wp-admin/dq/

xlm40.dropper

http://www.asyadegirmen.com/Template/nEMRY55nQgF/

xlm40.dropper

https://westthamesphysio.com/blog/D8AAkEyZ7u/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2676	1312	regsvr32.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1312	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1312	EXCEL.EXE
1312	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE
1312	EXCEL.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2676	1312	EXCEL.EXE	91
PID 1312 wrote to memory of 2676	1312	EXCEL.EXE	91
PID 1312 wrote to memory of 2676	1312	EXCEL.EXE	91

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8c9daf3ae83f4fdebad6f09fab1fe68050b4b2b6269ddf9896e6ff8b985b66b6.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWow64\regsvr32.exe
  C:\Windows\SysWow64\regsvr32.exe -s ..\rds.ocx
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
7d71d958c89dd5937723e45eb7721399

SHA1
8ee73c275233911407f897db1c2f06792cfac58f

SHA256
2b99ff0e8e8a81f6db48d259e5be4f1db334d43cd812409d1ca800426ad86e9b

SHA512
5ad9037e6e244a930bdce0828e926c715a0b0db0e81adcb2e32adb77e77dd5d3d1f9e2f74a5a4bdfc591a351ac3302a9924ef9f6ea070cefcdee023e4e4e034b

Download Submit
C:\Users\Admin\rds.ocx

Filesize
966B

MD5
1a8978d9d37041fe0089728cd6c23233

SHA1
f0485019f25ee50bb77f23081a8964e28e56cfb2

SHA256
87a97454942b85b5afc9cb9733bb7ce96cdf3422f6bfc95823f8edf6b2e2c607

SHA512
9ea43ede1eab73d3ac65bc3e9c13836c51d768daf5e300a0f57a26c0ca9cb2655455e5731664a92c969520dc05f7c71292d6a947405e06c2b1f88a399cd8d42b

Download Submit
memory/1312-5-0x00007FFC9A290000-0x00007FFC9A2A0000-memory.dmp

Filesize
64KB

Download
memory/1312-12-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-4-0x00007FFC9A290000-0x00007FFC9A2A0000-memory.dmp

Filesize
64KB

Download
memory/1312-1-0x00007FFCDA2AD000-0x00007FFCDA2AE000-memory.dmp

Filesize
4KB

Download
memory/1312-8-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-7-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-6-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-11-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-9-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-2-0x00007FFC9A290000-0x00007FFC9A2A0000-memory.dmp

Filesize
64KB

Download
memory/1312-10-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-13-0x00007FFC97B60000-0x00007FFC97B70000-memory.dmp

Filesize
64KB

Download
memory/1312-14-0x00007FFC97B60000-0x00007FFC97B70000-memory.dmp

Filesize
64KB

Download
memory/1312-3-0x00007FFC9A290000-0x00007FFC9A2A0000-memory.dmp

Filesize
64KB

Download
memory/1312-38-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-39-0x00007FFCDA2AD000-0x00007FFCDA2AE000-memory.dmp

Filesize
4KB

Download
memory/1312-40-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-41-0x00007FFCDA210000-0x00007FFCDA405000-memory.dmp

Filesize
2.0MB

Download
memory/1312-0-0x00007FFC9A290000-0x00007FFC9A2A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads