Analysis
- max time kernel
57s - max time network
110s - platform
windows10_x64 - resource
win10 - submitted
08/07/2020, 00:51
General
- Target DHL-Fattura-Cash-823910-5480.xls
- Size 70KB
- Sample200708-sd7jyv6bs6
- SHA256 8af0b10aedde4add9d62ece81efb0112263973cebce8828b7d045d8ffd15ce55
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 8 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Program crash 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\DHL-Fattura-Cash-823910-5480.xls"1⤵
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3176 -s 45642⤵
- Process spawned unexpected child process
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/584-2-0x0000024C1DFF0000-0x0000024C1DFF1000-memory.dmp
memory/584-3-0x0000024C1DFF0000-0x0000024C1DFF1000-memory.dmp
memory/584-5-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-6-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-7-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-8-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-9-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-10-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-11-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-12-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-13-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-14-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-15-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-16-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-17-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-18-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-19-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-20-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-21-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-23-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-22-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-24-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-25-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-26-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-27-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-28-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-29-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-30-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-31-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-32-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-33-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-34-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-35-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-36-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-37-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-38-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-39-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-40-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-41-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-42-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-43-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-44-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-46-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-45-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-50-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-47-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-48-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-49-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-51-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-52-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-53-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-54-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-55-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-56-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-57-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-58-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-59-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-60-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-61-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-62-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-63-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-64-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-65-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-66-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-67-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-68-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-69-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-70-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-71-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-72-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-73-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-74-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-75-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-76-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-77-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-78-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-80-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-79-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-81-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-82-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-83-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-84-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-85-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-86-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-87-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-88-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-89-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-90-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-91-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-92-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-93-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-94-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-95-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-96-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-97-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-98-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-99-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-100-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-101-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-102-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-103-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-104-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-105-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-106-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-107-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-108-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-109-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-110-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-111-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-112-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-113-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-114-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-115-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-116-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-117-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-118-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-119-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-120-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-121-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-122-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-123-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-124-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-125-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-126-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-127-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-128-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-129-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-130-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-131-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-132-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-133-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-134-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-135-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-136-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-137-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-138-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-139-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-140-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-141-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-142-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-143-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-144-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-145-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-146-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-147-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-148-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-149-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-151-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-150-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp
memory/584-153-0x0000024C1ED60000-0x0000024C1ED61000-memory.dmp