9eb3ac05340da70c56dc36e8beece9a7c052c945fc3ceade2c622c4defec54b3

General

Target

PurchaseOrdersheet.xls
Size

1.3MB
MD5

777464f57cb83a39b7324d1f7505b6d6
SHA1

25acb95ef77574c20002165e6b68526d7318acd1
SHA256

9eb3ac05340da70c56dc36e8beece9a7c052c945fc3ceade2c622c4defec54b3
SHA512

6609bfa04a5ae724eabd2f13c992a255554ae910ce6bcd6d25a62d8e2652d8aa129eae0908e266e3dfa808c19708a0a45c9b2922c531e03b1c2142847dbab8e3
SSDEEP

24576:pVH9M2HUO8Yfb3B/RvUp9EKDE/XY6lRvmfOdkGRjXv4cGysQYcb06hp8IJh1:LdMj/cb3I6Kg/ooofOdkGRXQcGTlczD

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
53	3348	Process not Found

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1064	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4808	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE
4808	EXCEL.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PurchaseOrdersheet.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTg4RjUwNzktQTkyOC00ODhGLUEyMjYtNzVEQTgzNTJFRkJEfSIgdXNlcmlkPSJ7QzhDNzMwM0UtREVEQS00REM5LTlBMzItOTEzNDYzMjNCMDRBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OUQ4QjhBMEUtNzc1MC00NzdELUI2RUYtNDZGNkI2QjBDMTZBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDU2MTU1MzkxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
26c49e6c12b03e5730fc31fa10c2b479

SHA1
d888ebdf5f15472db57c2f56b42c131488661250

SHA256
b4b29284bc370f7a527d2e3d235e00d8668e0276d6c42d82e39e583a4f3bb416

SHA512
2594732be7b88414520b235bb2dd47213498ce0fcc4e46b09ba46413dab5218bdcc726e29826932a5790f4b344fc5f566840cf3948e993aa49ca5bf1afc405ec

Download Submit
memory/4808-7-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-9-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-2-0x00007FFC4A630000-0x00007FFC4A640000-memory.dmp

Filesize
64KB

Download
memory/4808-5-0x00007FFC4A630000-0x00007FFC4A640000-memory.dmp

Filesize
64KB

Download
memory/4808-4-0x00007FFC4A630000-0x00007FFC4A640000-memory.dmp

Filesize
64KB

Download
memory/4808-6-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-0-0x00007FFC4A630000-0x00007FFC4A640000-memory.dmp

Filesize
64KB

Download
memory/4808-8-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-11-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-10-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-3-0x00007FFC4A630000-0x00007FFC4A640000-memory.dmp

Filesize
64KB

Download
memory/4808-12-0x00007FFC47D00000-0x00007FFC47D10000-memory.dmp

Filesize
64KB

Download
memory/4808-21-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-18-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-17-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-19-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-14-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-20-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-16-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-15-0x00007FFC47D00000-0x00007FFC47D10000-memory.dmp

Filesize
64KB

Download
memory/4808-13-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-33-0x00007FFC8A5B0000-0x00007FFC8A7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-34-0x00007FFC8A64D000-0x00007FFC8A64E000-memory.dmp

Filesize
4KB

Download
memory/4808-1-0x00007FFC8A64D000-0x00007FFC8A64E000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads