Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
13-07-2020 06:53
Static task
static1
Behavioral task
behavioral1
Sample
MV Caribe Angela.xlsx
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MV Caribe Angela.xlsx
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
MV Caribe Angela.xlsx
-
Size
179KB
-
MD5
1b402debe2be6e5bf91e932a8f0c9886
-
SHA1
3d3053788758dcb747a49b20489cde5cec64a3ea
-
SHA256
5e2759a3bbbbf9e8cd16ece86e9fafe5495810e798bbb355af61eb4ec175cae5
-
SHA512
20d9137b2e0d709abbb7edb478a4c3c84817c652d3b40ca4e492aae663ba502cf03bf916fde5aea1056e3591e9cc93f29ec3d71d907ff1e2da5af78153a6e886
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEEXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
WINWORD.EXEEXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
EXCEL.EXEWINWORD.EXEpid process 664 EXCEL.EXE 664 EXCEL.EXE 664 EXCEL.EXE 664 EXCEL.EXE 664 EXCEL.EXE 664 EXCEL.EXE 664 EXCEL.EXE 664 EXCEL.EXE 664 EXCEL.EXE 3904 WINWORD.EXE 664 EXCEL.EXE 664 EXCEL.EXE 664 EXCEL.EXE 3904 WINWORD.EXE 3904 WINWORD.EXE 3904 WINWORD.EXE 3904 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
EXCEL.EXEWINWORD.EXEpid process 664 EXCEL.EXE 3904 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WINWORD.EXEdescription pid process Token: SeAuditPrivilege 3904 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 3904 wrote to memory of 3440 3904 WINWORD.EXE splwow64.exe PID 3904 wrote to memory of 3440 3904 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\MV Caribe Angela.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4FFTI156\invoice_214744[1].doc
-
C:\Users\Admin\AppData\Local\Temp\.ses
-
memory/3440-1-0x0000000000000000-mapping.dmp