Overview

overview

10

Static

static

8

st_377.xls

windows7_x64

10

st_377.xls

windows10_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    08-07-2020 12:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    st_377.xls

  • Size

    154KB

  • MD5

    28cdbfd0bdf481f1278eddf2302072fc

  • SHA1

    442aa2998ba02c341bc3fd94825c3ee0394edccd

  • SHA256

    82dc27524ee531accf53dea3200f8f9ea4e7c3a9f0d49e0be1d45109ab3bc8f6

  • SHA512

    dbf465c6d25ae0d385b1da0a5da43304d5c04858ac5e1b0f8b42801974332332cddcbff206a24b53979ce3e3ca3a7aa029d212451f27a3dfa9986a087a1412f7

Score
10/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of WriteProcessMemory 4 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\st_377.xls"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of WriteProcessMemory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:3748
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs
      2⤵
      • Process spawned unexpected child process
      PID:3924
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    • Modifies registry class
    PID:3544
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs"
      2⤵
        PID:1880

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\A2FOoXb.vbs
      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\mE8gE9.txt
      Download Submit
    • memory/1880-2-0x0000000000000000-mapping.dmp
      Download
    • memory/3924-0-0x0000000000000000-mapping.dmp
      Download