18675f25203e08b39f835cec09a3697c6b1998dadcf22ba528828184f9f4515a

General

Target

18675f25203e08b39f835cec09a3697c6b1998dadcf22ba528828184f9f4515a.xls
Size

1.1MB
MD5

73346e64a29d684532eca0a6a17e8f4c
SHA1

61980a1ee86bfe46bccfc5d2262c635dc06bf6b6
SHA256

18675f25203e08b39f835cec09a3697c6b1998dadcf22ba528828184f9f4515a
SHA512

9e821cbde002e872c03ef05adfe720efebb729a655747bde5d8e81e2949bc199b3c3774d476610d24a5b37b4c69c0cad521561904030e6657bf1aed27d007dda
SSDEEP

24576:Auq9PLiijE2Z5Z2am4ZFb9+k5HbW3kZiyihBMpOLpEI:AuEPLiij7Z5ZKA9l5HbWUsK0

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1492	5028	mshta.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

5028 EXCEL.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

EXCEL.EXE

pid process

5028 EXCEL.EXE
5028 EXCEL.EXE
5028 EXCEL.EXE
5028 EXCEL.EXE
5028 EXCEL.EXE
5028 EXCEL.EXE
5028 EXCEL.EXE
5028 EXCEL.EXE
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description pid process target process

PID 5028 wrote to memory of 1492 5028 EXCEL.EXE mshta.exe
PID 5028 wrote to memory of 1492 5028 EXCEL.EXE mshta.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

pid	process
5028	EXCEL.EXE

pid	process
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE

description	pid	process	target process
PID 5028 wrote to memory of 1492	5028	EXCEL.EXE	mshta.exe
PID 5028 wrote to memory of 1492	5028	EXCEL.EXE	mshta.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\18675f25203e08b39f835cec09a3697c6b1998dadcf22ba528828184f9f4515a.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\System32\mshta.exe
  C:\Windows\System32\mshta.exe -Embedding
  2⤵
  - Process spawned unexpected child process
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
20827e08c79415590337a7c2520e093c

SHA1
bd754233e245efb8a7e1247f2de882481047ff57

SHA256
f9c1d919c33daed5e242f83ad82307c8c03dd74688d015d2e0d49265491ff4e7

SHA512
717b232b3ab695c3e127049a1b485ae0d369b5ab2c1ea66d4486e1ed2de6e7d5f593001224b2b5f8b5df2baee4b6fa4f7226ab3e60bd156ab5a48f74740dc49f

Download Submit
memory/1492-39-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/1492-48-0x00007FF7A6800000-0x00007FF7A6808000-memory.dmp

Filesize
32KB

Download
memory/1492-47-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-12-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-15-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-7-0x00007FF8FB2F0000-0x00007FF8FB300000-memory.dmp

Filesize
64KB

Download
memory/5028-6-0x00007FF8FB2F0000-0x00007FF8FB300000-memory.dmp

Filesize
64KB

Download
memory/5028-11-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-13-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-0-0x00007FF8FB2F0000-0x00007FF8FB300000-memory.dmp

Filesize
64KB

Download
memory/5028-10-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-14-0x00007FF8F8CB0000-0x00007FF8F8CC0000-memory.dmp

Filesize
64KB

Download
memory/5028-5-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-9-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-8-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-16-0x00007FF8F8CB0000-0x00007FF8F8CC0000-memory.dmp

Filesize
64KB

Download
memory/5028-4-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-42-0x00007FF93B270000-0x00007FF93B465000-memory.dmp

Filesize
2.0MB

Download
memory/5028-43-0x00007FF93B30D000-0x00007FF93B30E000-memory.dmp

Filesize
4KB

Download
memory/5028-3-0x00007FF8FB2F0000-0x00007FF8FB300000-memory.dmp

Filesize
64KB

Download
memory/5028-2-0x00007FF8FB2F0000-0x00007FF8FB300000-memory.dmp

Filesize
64KB

Download
memory/5028-1-0x00007FF93B30D000-0x00007FF93B30E000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads