Overview

overview

10

Static

static

MV Caribe Angela.xlsx

windows7_x64

10

MV Caribe Angela.xlsx

windows10_x64

1

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    13-07-2020 06:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MV Caribe Angela.xlsx

  • Size

    179KB

  • MD5

    1b402debe2be6e5bf91e932a8f0c9886

  • SHA1

    3d3053788758dcb747a49b20489cde5cec64a3ea

  • SHA256

    5e2759a3bbbbf9e8cd16ece86e9fafe5495810e798bbb355af61eb4ec175cae5

  • SHA512

    20d9137b2e0d709abbb7edb478a4c3c84817c652d3b40ca4e492aae663ba502cf03bf916fde5aea1056e3591e9cc93f29ec3d71d907ff1e2da5af78153a6e886

Score
10/10
spywaretrojanstealerformbookpersistenceevasion

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

    exploit
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Adds Run entry to start application 2 TTPs 2 IoCs
    persistence
  • Loads dropped DLL 4 IoCs
  • Blacklisted process makes network request 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Abuses OpenXML format to download file from external location 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Drops file in Program Files directory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    PID:1228
    • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\MV Caribe Angela.xlsx"
      2⤵
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Abuses OpenXML format to download file from external location
      • Suspicious use of SetWindowsHookEx
      PID:1492
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Adds Run entry to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Drops file in Program Files directory
      PID:2012
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Roaming\vbc.exe"
        3⤵
          PID:2024
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1904
      • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
        1⤵
        • Abuses OpenXML format to download file from external location
        • Suspicious use of SetWindowsHookEx
        PID:1744
      • C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        • Loads dropped DLL
        • Blacklisted process makes network request
        PID:1892
        • C:\Users\Admin\AppData\Roaming\vbc.exe
          "C:\Users\Admin\AppData\Roaming\vbc.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetThreadContext
          PID:1812
          • C:\Users\Admin\AppData\Roaming\vbc.exe
            "C:\Users\Admin\AppData\Roaming\vbc.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:1636

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Exploitation for Client Execution

      1
      T1203

      Scripting

      1
      T1064

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Modify Registry

      2
      T1112

      Scripting

      1
      T1064

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZQ107GEP\invoice_214744[1].doc
        Download Submit
      • C:\Users\Admin\AppData\Roaming\3N6NTOD3\3N6logim.jpeg
        Download Submit
      • C:\Users\Admin\AppData\Roaming\3N6NTOD3\3N6logrf.ini
        Download Submit
      • C:\Users\Admin\AppData\Roaming\3N6NTOD3\3N6logri.ini
        Download Submit
      • C:\Users\Admin\AppData\Roaming\3N6NTOD3\3N6logrv.ini
        Download Submit
      • C:\Users\Admin\AppData\Roaming\vbc.exe
        Download Submit
      • C:\Users\Admin\AppData\Roaming\vbc.exe
        Download Submit
      • C:\Users\Admin\AppData\Roaming\vbc.exe
        Download Submit
      • \Users\Admin\AppData\Roaming\vbc.exe
        Download Submit
      • \Users\Admin\AppData\Roaming\vbc.exe
        Download Submit
      • \Users\Admin\AppData\Roaming\vbc.exe
        Download Submit
      • \Users\Admin\AppData\Roaming\vbc.exe
        Download Submit
      • memory/1492-13-0x0000000002180000-0x0000000002181000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1492-11-0x0000000002180000-0x0000000002181000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1636-9-0x000000000041E310-mapping.dmp
        Download
      • memory/1636-8-0x0000000000400000-0x000000000042D000-memory.dmp
        Filesize

        180KB

        Download
      • memory/1812-5-0x0000000000000000-mapping.dmp
        Download
      • memory/1904-21-0x0000000000000000-mapping.dmp
        Download
      • memory/1904-22-0x000000013F4A0000-0x000000013F533000-memory.dmp
        Filesize

        588KB

        Download
      • memory/2012-14-0x0000000000000000-mapping.dmp
        Download
      • memory/2012-15-0x0000000000830000-0x0000000000846000-memory.dmp
        Filesize

        88KB

        Download
      • memory/2012-17-0x0000000003050000-0x000000000314B000-memory.dmp
        Filesize

        1004KB

        Download
      • memory/2012-18-0x0000000076820000-0x000000007697C000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/2012-20-0x0000000003540000-0x00000000035FD000-memory.dmp
        Filesize

        756KB

        Download
      • memory/2024-16-0x0000000000000000-mapping.dmp
        Download