Overview

overview

8

Static

static

Shipper Co...0.xlsx

windows7_x64

8

Shipper Co...0.xlsx

windows10_x64

1

Analysis

  • max time kernel
    147s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    08-07-2020 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Shipper Confirmation Request IMEG30540.xlsx

  • Size

    14KB

  • MD5

    04265796102a139484132ac03663d232

  • SHA1

    94f3b87d57abf845cb8fb84fe2817c1aca242317

  • SHA256

    81a9ed11a592e1bbcfd5e1d2f4cc1d8b38aa5b8eed7a76f7a13ae48fafa9be27

  • SHA512

    78fa5df3680fa6ee5fea5caf441fb130ed88612037aa3609ea16dfbae82bb268a46f0643b91cdfcc3ccc195facb3adfc6d958f31df59de00ccbc5b205d8d0456

Score
8/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Blacklisted process makes network request 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

    exploit
  • Loads dropped DLL 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1284
    • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Shipper Confirmation Request IMEG30540.xlsx"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1400
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      PID:1868
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Roaming\regasms.exe"
        3⤵
          PID:2000
    • C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blacklisted process makes network request
      • Suspicious use of WriteProcessMemory
      • Launches Equation Editor
      • Loads dropped DLL
      PID:676
      • C:\Users\Admin\AppData\Roaming\regasms.exe
        C:\Users\Admin\AppData\Roaming\regasms.exe
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        PID:1824
        • C:\Users\Admin\AppData\Roaming\regasms.exe
          "{path}"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Executes dropped EXE
          • Suspicious behavior: MapViewOfSection
          PID:1880

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Exploitation for Client Execution

    1
    T1203

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\regasms.exe
      Download Submit
    • C:\Users\Admin\AppData\Roaming\regasms.exe
      Download Submit
    • C:\Users\Admin\AppData\Roaming\regasms.exe
      Download Submit
    • \Users\Admin\AppData\Roaming\regasms.exe
      Download Submit
    • memory/1824-1-0x0000000000000000-mapping.dmp
      Download
    • memory/1868-7-0x0000000000000000-mapping.dmp
      Download
    • memory/1868-8-0x0000000000550000-0x0000000000572000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1868-10-0x0000000003110000-0x00000000031B6000-memory.dmp
      Filesize

      664KB

      Download
    • memory/1880-4-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB

      Download
    • memory/1880-5-0x000000000041E200-mapping.dmp
      Download
    • memory/2000-9-0x0000000000000000-mapping.dmp
      Download