Overview

overview

1

Static

static

URGENT.xlsx

windows7_x64

1

URGENT.xlsx

windows10_x64

1

Resubmissions

07-07-2020 11:46

200707-l66r2vh3ha 1

07-07-2020 11:42

200707-mrc92g3k5j 1

07-07-2020 11:12

200707-8s9ccyfyp2 1

Analysis

  • max time kernel
    103s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    07-07-2020 11:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    URGENT.xlsx

  • Size

    85KB

  • MD5

    d79b99270ed6b1a7767fa1e62ced9e20

  • SHA1

    03caddc36c3501dfa28b69113506a597953ee901

  • SHA256

    57526978347b4a435a44c0ca55149ac9cd8bdb0def66c73df52cda81ac8b5546

  • SHA512

    14148b0656d00c09f455126c3bc6c787e06eee23a7a7c49577f6c9f7f03ee19b8f64dd0405bfe84db600bcf6599e3e030b5a4d4360b524ed90fe73428941c076

Score
1/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 37 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\URGENT.xlsx"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    PID:3908
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\URGENT.xlsx"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: EnumeratesProcesses
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4
    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1CD59895-6C98-42A7-941F-D8254AE689CC
    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db
    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\.ses
    Download Submit