245303a91378f8739407e2b274e91c77313ad43d837bf1448f2d84e61338ecb7

General

Target

中国南方电网有限责任公司总部2012年一级物资集中招标35千伏及以上交流项�.xls
Size

101KB
MD5

1123c713785cd680d015e668b3ac3a60
SHA1

1684dfb921fd927812128514b71cd3b0602e2e6b
SHA256

ca2f3feb4d2a33868b2f56d8ac67635fe06dab621c7fbecc3c397a930137049f
SHA512

0ec8a6b7a942f1719daddced0fcbaae88a090278447e18ffe3608b8a1360371139671c7e4262b07729d32e732f069141d7e30cc7144894dfd07f32fe662616c1
SSDEEP

1536:1gA7lfG3TnmL4URTvjEb2jcc0lbxOvTgZGbhY7nJdJoOd7cJtXwYaNu:5lfG3TnmK2jcc0lbxOr52AJtXwbE

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1000	2104	cmd.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1508	2104	cmd.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1776	2104	cmd.exe	EXCEL.EXE

Deletes itself 1 IoCs

Processes:

EXCEL.EXE

pid process

2104 EXCEL.EXE
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

pid	process
2104	EXCEL.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeEXCEL.EXEcmd.exeattrib.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\75E67F00\:Zone.Identifier:$DATA EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2104 EXCEL.EXE
Suspicious behavior: RenamesItself 1 IoCs

Processes:

EXCEL.EXE

pid process

2104 EXCEL.EXE
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXE

pid process

2104 EXCEL.EXE
2104 EXCEL.EXE
2104 EXCEL.EXE
2104 EXCEL.EXE
2104 EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\75E67F00\:Zone.Identifier:$DATA	EXCEL.EXE

pid	process
2104	EXCEL.EXE

pid	process
2104	EXCEL.EXE

pid	process
2104	EXCEL.EXE
2104	EXCEL.EXE
2104	EXCEL.EXE
2104	EXCEL.EXE
2104	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

EXCEL.EXEcmd.exe

description	pid	process	target process
PID 2104 wrote to memory of 1000	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1000	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1000	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1000	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1508	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1508	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1508	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1508	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1776	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1776	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1776	2104	EXCEL.EXE	cmd.exe
PID 2104 wrote to memory of 1776	2104	EXCEL.EXE	cmd.exe
PID 1000 wrote to memory of 664	1000	cmd.exe	attrib.exe
PID 1000 wrote to memory of 664	1000	cmd.exe	attrib.exe
PID 1000 wrote to memory of 664	1000	cmd.exe	attrib.exe
PID 1000 wrote to memory of 664	1000	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

664 attrib.exe

pid	process
664	attrib.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\中国南方电网有限责任公司总部2012年一级物资集中招标35千伏及以上交流项�.xls
1⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2104-1-0x00000000728CD000-0x00000000728D8000-memory.dmp

Filesize
44KB

Download
memory/2104-5-0x0000000006360000-0x0000000006460000-memory.dmp

Filesize
1024KB

Download
memory/2104-9-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-10-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-16-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-11-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-12-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-13-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-14-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-23-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-24-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-22-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-21-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-20-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-19-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-18-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-17-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-15-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-30-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-29-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-28-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-27-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-26-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-25-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-47-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-32-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-31-0x0000000006360000-0x0000000006460000-memory.dmp

Filesize
1024KB

Download
memory/2104-72-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-100-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-331-0x00000000728CD000-0x00000000728D8000-memory.dmp

Filesize
44KB

Download
memory/2104-332-0x0000000006360000-0x0000000006460000-memory.dmp

Filesize
1024KB

Download
memory/2104-333-0x0000000006360000-0x0000000006460000-memory.dmp

Filesize
1024KB

Download
memory/2104-334-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-335-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2104-336-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads