Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
24-06-2020 14:57
Static task
static1
Behavioral task
behavioral1
Sample
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr
-
Size
1.4MB
-
MD5
c6bed0ae958f524c96ea66abe4388143
-
SHA1
e004388f83243650ed3dd97564d0ba7461560538
-
SHA256
690fd66b2d2844fa4bd98c0b1f79fbf7fe9c38c5f187d1ee05757bda9c28984e
-
SHA512
ea286c26a54ecbfc21507b9128b47646a331c07602b99d87a84166662d32a650bcb5f2c13052304119aa3845566c4bbaa9c8eed47e3aecc17cc6b44851bcf741
Score
7/10
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scrpid process 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scrpid process 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MSBuild.exepid process 1128 MSBuild.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\SERVER\\SERVER.exe" MSBuild.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scrdescription pid process target process PID 1092 wrote to memory of 1128 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr MSBuild.exe PID 1092 wrote to memory of 1128 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr MSBuild.exe PID 1092 wrote to memory of 1128 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr MSBuild.exe PID 1092 wrote to memory of 1128 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr MSBuild.exe PID 1092 wrote to memory of 1128 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr MSBuild.exe PID 1092 wrote to memory of 1128 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scrdescription pid process target process PID 1092 set thread context of 1128 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 1128 MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scrpid process 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr 1092 COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr -
Drops startup file 1 IoCs
Processes:
COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scrdescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcryptprimitives.url COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr"C:\Users\Admin\AppData\Local\Temp\COVID-19 PALLIATIVES BONUS ON PAGA.xlsx.scr" /S1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Adds Run entry to start application
- Suspicious use of SetWindowsHookEx