245303a91378f8739407e2b274e91c77313ad43d837bf1448f2d84e61338ecb7

General

Target

中国南方电网有限责任公司总部2012年一级物资集中招标35千伏及以上交流项�.xls
Size

101KB
MD5

1123c713785cd680d015e668b3ac3a60
SHA1

1684dfb921fd927812128514b71cd3b0602e2e6b
SHA256

ca2f3feb4d2a33868b2f56d8ac67635fe06dab621c7fbecc3c397a930137049f
SHA512

0ec8a6b7a942f1719daddced0fcbaae88a090278447e18ffe3608b8a1360371139671c7e4262b07729d32e732f069141d7e30cc7144894dfd07f32fe662616c1
SSDEEP

1536:1gA7lfG3TnmL4URTvjEb2jcc0lbxOvTgZGbhY7nJdJoOd7cJtXwYaNu:5lfG3TnmK2jcc0lbxOr52AJtXwbE

Score

10^/10

defense_evasion macro xlm

Malware Config

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4636	1340	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4208	1340	cmd.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	920	1340	cmd.exe	EXCEL.EXE

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\中国南方电网有限责任公司总部2012年一级物资集中招标35千伏及以上交流项�.xls	office_xlm_macros

Deletes itself 1 IoCs

Processes:

EXCEL.EXE

pid process

1340 EXCEL.EXE
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\1AB75E00\:Zone.Identifier:$DATA EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1340 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

1340 EXCEL.EXE
1340 EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\1AB75E00\:Zone.Identifier:$DATA	EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EXCEL.EXEcmd.exe

description	pid	process	target process
PID 1340 wrote to memory of 920	1340	EXCEL.EXE	cmd.exe
PID 1340 wrote to memory of 920	1340	EXCEL.EXE	cmd.exe
PID 1340 wrote to memory of 4208	1340	EXCEL.EXE	cmd.exe
PID 1340 wrote to memory of 4208	1340	EXCEL.EXE	cmd.exe
PID 1340 wrote to memory of 4636	1340	EXCEL.EXE	cmd.exe
PID 1340 wrote to memory of 4636	1340	EXCEL.EXE	cmd.exe
PID 920 wrote to memory of 1624	920	cmd.exe	attrib.exe
PID 920 wrote to memory of 1624	920	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1624 attrib.exe

pid	process
1624	attrib.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\中国南方电网有限责任公司总部2012年一级物资集中招标35千伏及以上交流项�.xls"
1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\attrib.exe
    attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
    3⤵
    - Views/modifies file attributes
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
  2⤵
  - Process spawned unexpected child process
  PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\中国南方电网有限责任公司总部2012年一级物资集中招标35千伏及以上交流项�.xls

Filesize
136KB

MD5
88057ad8feb054b4ccbc2e22dfd4d209

SHA1
908522828c251edfa4c2b4578352be441377bba7

SHA256
a84e3f60980fdffaa6bdfc00ccb690bab59c1e8a69eb699badc5c302bd4003ad

SHA512
4fdbb398b50529748fb430b94dbcedd4f8df7b913c47965383db8e381635dbe7cf178f1591fe5a4fbb570341ac181ecbf180e6398d3635ea8667a4bb867a6fda

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
4KB

MD5
c380f607f97237dc27041444c4caa87e

SHA1
ef9fe89e5da66172b5080a3064f40f73b79e2401

SHA256
2a66f016d48a58b8d3a5ea8cc89a382e145178c88cc4743558e7bede5b952ec3

SHA512
c941ae752c9b57c6431301cbc75a3203373b4ac10ab0d077751ec9a71c7d93a1ee2d2a9640968fdf681c77775674bc926d4ec6e18a33b5784b44d257b8b890ba

Download Submit
memory/1340-19-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-3-0x00007FFC1B2CD000-0x00007FFC1B2CE000-memory.dmp

Filesize
4KB

Download
memory/1340-2-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/1340-0-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/1340-9-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-8-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-11-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-12-0x00007FFBD8F80000-0x00007FFBD8F90000-memory.dmp

Filesize
64KB

Download
memory/1340-6-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-13-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-7-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-14-0x00007FFBD8F80000-0x00007FFBD8F90000-memory.dmp

Filesize
64KB

Download
memory/1340-10-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-16-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-1-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/1340-18-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-5-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/1340-17-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-15-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-56-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-54-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-57-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-58-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-59-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-71-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-72-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-73-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-4-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/1340-106-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-110-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/1340-20-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads