Overview

overview

6

Static

static

SecuriteIn...55.xls

windows7_x64

6

SecuriteIn...55.xls

windows10_x64

6

Analysis

  • max time kernel
    141s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    09/07/2020, 15:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.XLM.Trojan.Abracadabra.1.Gen.30953.18655.xls

  • Size

    690KB

  • MD5

    720a5d88e66d53347ac4318371258379

  • SHA1

    160be83ca612a9da4ee8c0f445e2c12dc6b4e19e

  • SHA256

    617b85bbb3d9c6278c69d899fc91a06f5b843e0db503da23eed661af3626754c

  • SHA512

    226a470fdfd271a64320aa87dd7d262515cc6f5af59f7d6d2df3b5443f903da44b0a28f542785a72d2d5111d160a6f8899c03916fdeed0e30daf7f994c932c8c

Score
6/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Suspicious use of WriteProcessMemory 4 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.XLM.Trojan.Abracadabra.1.Gen.30953.18655.xls"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:968
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4472
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4472
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3876

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3876-2-0x000002AAD6980000-0x000002AAD6981000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3876-3-0x000002AAD6980000-0x000002AAD6981000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3876-5-0x000002AAD7170000-0x000002AAD7171000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3876-8-0x000002AAD7390000-0x000002AAD7391000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3876-9-0x000002AAD7390000-0x000002AAD7391000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3876-10-0x000002AAD7390000-0x000002AAD7391000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3876-11-0x000002AAD70B0000-0x000002AAD70B1000-memory.dmp

    Filesize

    4KB

    Download