d2284b9edff9d25b37c9e35218823c8638c1519caeb3efeac6dc10cd7c9e4a46

General

Target

d2284b9edff9d25b37c9e35218823c8638c1519caeb3efeac6dc10cd7c9e4a46.xls
Size

46KB
MD5

c46c558bf5c419da1085d328ce73f73f
SHA1

166427c22205e83bb686cf7c8e8ff9bedd68d85d
SHA256

d2284b9edff9d25b37c9e35218823c8638c1519caeb3efeac6dc10cd7c9e4a46
SHA512

86d023fd3fc909713cb8c605f48431ddc25e06a9352e3accd1ee579a382245e0578babd98068ef5ccf5f2dd2618350610048551a2b8edb234c75d9791f7e6078
SSDEEP

768:7DMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+Vyis73q/44fq/uVG:7YKpb8rGYrMPe3q7Q0XV5xtezE8vG8U2

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.zardamarine.com/images/psQbAjrrEOXWPrS/

xlm40.dropper

http://kronostr.com/tr/68yHRhfuU7Qj/

xlm40.dropper

http://labfitouts.com/cgi-bin/Rea3Iu3wGvgAbTset0/

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4828	1780	regsvr32.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1032	1780	regsvr32.exe	82
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	516	1780	regsvr32.exe	82

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1780	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1780	EXCEL.EXE
1780	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE
1780	EXCEL.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 4828	1780	EXCEL.EXE	87
PID 1780 wrote to memory of 4828	1780	EXCEL.EXE	87
PID 1780 wrote to memory of 1032	1780	EXCEL.EXE	88
PID 1780 wrote to memory of 1032	1780	EXCEL.EXE	88
PID 1780 wrote to memory of 516	1780	EXCEL.EXE	89
PID 1780 wrote to memory of 516	1780	EXCEL.EXE	89

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d2284b9edff9d25b37c9e35218823c8638c1519caeb3efeac6dc10cd7c9e4a46.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\wdusx1.ocx
  2⤵
  - Process spawned unexpected child process
  PID:4828
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\wdusx2.ocx
  2⤵
  - Process spawned unexpected child process
  PID:1032
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\wdusx3.ocx
  2⤵
  - Process spawned unexpected child process
  PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
e632d559317fcd8e83dc9d3c7c96f337

SHA1
dc284568b92345f80625908bedcafef0ef4cc150

SHA256
11ada7dac38fa631e7faff2e62cc2b5fcaa8688d4499941b4e116ebe9a22b537

SHA512
4551cb9ae0793082d2a86abf02f6155ec2ac18810461808a73e902edd6f31b935a4afba49b4be558e05aa873ee7ff0b3ff331f60f84ae922af2c9eabcb7680ff

Download Submit
memory/1780-15-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-13-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-4-0x00007FF953ED0000-0x00007FF953EE0000-memory.dmp

Filesize
64KB

Download
memory/1780-3-0x00007FF953ED0000-0x00007FF953EE0000-memory.dmp

Filesize
64KB

Download
memory/1780-6-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-5-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-8-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-9-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-14-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-1-0x00007FF993EED000-0x00007FF993EEE000-memory.dmp

Filesize
4KB

Download
memory/1780-2-0x00007FF953ED0000-0x00007FF953EE0000-memory.dmp

Filesize
64KB

Download
memory/1780-17-0x00007FF951C60000-0x00007FF951C70000-memory.dmp

Filesize
64KB

Download
memory/1780-16-0x00007FF951C60000-0x00007FF951C70000-memory.dmp

Filesize
64KB

Download
memory/1780-12-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-11-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-10-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-7-0x00007FF953ED0000-0x00007FF953EE0000-memory.dmp

Filesize
64KB

Download
memory/1780-32-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-33-0x00007FF993EED000-0x00007FF993EEE000-memory.dmp

Filesize
4KB

Download
memory/1780-34-0x00007FF993E50000-0x00007FF994045000-memory.dmp

Filesize
2.0MB

Download
memory/1780-0-0x00007FF953ED0000-0x00007FF953EE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads