Analysis
-
max time kernel
147s -
max time network
32s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 13:49
Static task
static1
Behavioral task
behavioral1
Sample
Shipper Confirmation Request IMEG30540.xlsx
Resource
win7v200430
Behavioral task
behavioral2
Sample
Shipper Confirmation Request IMEG30540.xlsx
Resource
win10
General
-
Target
Shipper Confirmation Request IMEG30540.xlsx
-
Size
14KB
-
MD5
04265796102a139484132ac03663d232
-
SHA1
94f3b87d57abf845cb8fb84fe2817c1aca242317
-
SHA256
81a9ed11a592e1bbcfd5e1d2f4cc1d8b38aa5b8eed7a76f7a13ae48fafa9be27
-
SHA512
78fa5df3680fa6ee5fea5caf441fb130ed88612037aa3609ea16dfbae82bb268a46f0643b91cdfcc3ccc195facb3adfc6d958f31df59de00ccbc5b205d8d0456
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
regasms.exeregasms.execscript.exedescription pid process target process PID 1824 set thread context of 1880 1824 regasms.exe regasms.exe PID 1880 set thread context of 1284 1880 regasms.exe Explorer.EXE PID 1868 set thread context of 1284 1868 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
regasms.execscript.exepid process 1880 regasms.exe 1880 regasms.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe 1868 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
regasms.execscript.exedescription pid process Token: SeDebugPrivilege 1880 regasms.exe Token: SeDebugPrivilege 1868 cscript.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1400 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE -
Blacklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 676 EQNEDT32.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EQNEDT32.EXEregasms.exeExplorer.EXEcscript.exedescription pid process target process PID 676 wrote to memory of 1824 676 EQNEDT32.EXE regasms.exe PID 676 wrote to memory of 1824 676 EQNEDT32.EXE regasms.exe PID 676 wrote to memory of 1824 676 EQNEDT32.EXE regasms.exe PID 676 wrote to memory of 1824 676 EQNEDT32.EXE regasms.exe PID 1824 wrote to memory of 1880 1824 regasms.exe regasms.exe PID 1824 wrote to memory of 1880 1824 regasms.exe regasms.exe PID 1824 wrote to memory of 1880 1824 regasms.exe regasms.exe PID 1824 wrote to memory of 1880 1824 regasms.exe regasms.exe PID 1824 wrote to memory of 1880 1824 regasms.exe regasms.exe PID 1824 wrote to memory of 1880 1824 regasms.exe regasms.exe PID 1824 wrote to memory of 1880 1824 regasms.exe regasms.exe PID 1284 wrote to memory of 1868 1284 Explorer.EXE cscript.exe PID 1284 wrote to memory of 1868 1284 Explorer.EXE cscript.exe PID 1284 wrote to memory of 1868 1284 Explorer.EXE cscript.exe PID 1284 wrote to memory of 1868 1284 Explorer.EXE cscript.exe PID 1868 wrote to memory of 2000 1868 cscript.exe cmd.exe PID 1868 wrote to memory of 2000 1868 cscript.exe cmd.exe PID 1868 wrote to memory of 2000 1868 cscript.exe cmd.exe PID 1868 wrote to memory of 2000 1868 cscript.exe cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
regasms.exeregasms.exepid process 1824 regasms.exe 1880 regasms.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
regasms.execscript.exepid process 1880 regasms.exe 1880 regasms.exe 1880 regasms.exe 1868 cscript.exe 1868 cscript.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 676 EQNEDT32.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE 1284 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Shipper Confirmation Request IMEG30540.xlsx"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\regasms.exe"3⤵
-
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Launches Equation Editor
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\regasms.exeC:\Users\Admin\AppData\Roaming\regasms.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\regasms.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\regasms.exe
-
C:\Users\Admin\AppData\Roaming\regasms.exe
-
C:\Users\Admin\AppData\Roaming\regasms.exe
-
\Users\Admin\AppData\Roaming\regasms.exe
-
memory/1824-1-0x0000000000000000-mapping.dmp
-
memory/1868-7-0x0000000000000000-mapping.dmp
-
memory/1868-8-0x0000000000550000-0x0000000000572000-memory.dmpFilesize
136KB
-
memory/1868-10-0x0000000003110000-0x00000000031B6000-memory.dmpFilesize
664KB
-
memory/1880-4-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1880-5-0x000000000041E200-mapping.dmp
-
memory/2000-9-0x0000000000000000-mapping.dmp