9eb3ac05340da70c56dc36e8beece9a7c052c945fc3ceade2c622c4defec54b3

General

Target

Purchase Order sheet.xla.xls
Size

1.3MB
MD5

777464f57cb83a39b7324d1f7505b6d6
SHA1

25acb95ef77574c20002165e6b68526d7318acd1
SHA256

9eb3ac05340da70c56dc36e8beece9a7c052c945fc3ceade2c622c4defec54b3
SHA512

6609bfa04a5ae724eabd2f13c992a255554ae910ce6bcd6d25a62d8e2652d8aa129eae0908e266e3dfa808c19708a0a45c9b2922c531e03b1c2142847dbab8e3
SSDEEP

24576:pVH9M2HUO8Yfb3B/RvUp9EKDE/XY6lRvmfOdkGRjXv4cGysQYcb06hp8IJh1:LdMj/cb3I6Kg/ooofOdkGRXQcGTlczD

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4872	2728	mshta.exe	82

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2728	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4872	2728	EXCEL.EXE	87
PID 2728 wrote to memory of 4872	2728	EXCEL.EXE	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Purchase Order sheet.xla.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\mshta.exe
  C:\Windows\System32\mshta.exe -Embedding
  2⤵
  - Process spawned unexpected child process
  PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
5718424baed85334f5ded3ada794e6a9

SHA1
1cff7af5b51f304d7592b198b9d4b0ffc4122978

SHA256
456efff0f87505c8aa24dea80df978ea56ebde1b2080ee5574b8c4fb3befe51a

SHA512
78d5428f9a27577a9afc6a6b2d953ca2c6aa08472bc56d55d99108148cf4ff4df966dda066473ede0d6922140c4f43f226c033f5b2c9acba6c49670d7123daf5

Download Submit
memory/2728-11-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-2-0x00007FF9ADC70000-0x00007FF9ADC80000-memory.dmp

Filesize
64KB

Download
memory/2728-12-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-4-0x00007FF9ADC70000-0x00007FF9ADC80000-memory.dmp

Filesize
64KB

Download
memory/2728-6-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-5-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-7-0x00007FF9ADC70000-0x00007FF9ADC80000-memory.dmp

Filesize
64KB

Download
memory/2728-8-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-14-0x00007FF9AB3F0000-0x00007FF9AB400000-memory.dmp

Filesize
64KB

Download
memory/2728-1-0x00007FF9EDC8D000-0x00007FF9EDC8E000-memory.dmp

Filesize
4KB

Download
memory/2728-0-0x00007FF9ADC70000-0x00007FF9ADC80000-memory.dmp

Filesize
64KB

Download
memory/2728-3-0x00007FF9ADC70000-0x00007FF9ADC80000-memory.dmp

Filesize
64KB

Download
memory/2728-9-0x00007FF9AB3F0000-0x00007FF9AB400000-memory.dmp

Filesize
64KB

Download
memory/2728-10-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-13-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/2728-48-0x00007FF9EDC8D000-0x00007FF9EDC8E000-memory.dmp

Filesize
4KB

Download
memory/2728-47-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/4872-46-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/4872-44-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/4872-43-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download
memory/4872-52-0x00007FF7CB470000-0x00007FF7CB478000-memory.dmp

Filesize
32KB

Download
memory/4872-40-0x00007FF9EDBF0000-0x00007FF9EDDE5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads