Overview

overview

8

Static

static

8

QO-77190441.xlsm

windows7_x64

6

QO-77190441.xlsm

windows10_x64

8

Analysis

  • max time kernel
    141s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    13-07-2020 07:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    QO-77190441.xlsm

  • Size

    64KB

  • MD5

    93897aa2998c1991834aa52bf86c0ad5

  • SHA1

    b91d37f744db2606709ec999f8eeb97c7b4c0514

  • SHA256

    b17553745e016653cace2242fbf6be5d91642e9ec2424d43f97d47576b2fc046

  • SHA512

    b6d3f60776846c1a74be4ae9c1b9615de03ef5d52e3590477e0a4a292f4eecea3c4f2ff8a834e5019a1472a9fd00241209018a9d5214dc9b1cea7a186cdae061

Score
8/10
evasionspywaretrojan

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    evasionspywaretrojan
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Checks whether UAC is enabled 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 101 IoCs
    adwarespyware

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\QO-77190441.xlsm"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of WriteProcessMemory
    • Modifies system certificate store
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:1492
    • C:\Users\Admin\Documents\ywqJGcy.exe
      "C:\Users\Admin\Documents\ywqJGcy.exe"
      2⤵
      • Executes dropped EXE
      PID:3388
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    PID:1104
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:82945 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      PID:1508
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    PID:688
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:688 CREDAT:82945 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      PID:2348
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    PID:3968
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3968 CREDAT:82945 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      PID:3612
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    PID:2196
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:82945 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      PID:1568
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    PID:3024
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:82945 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      PID:1204
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    PID:2124
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:82945 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
    Download Submit
  • C:\Users\Admin\Documents\ywqJGcy.exe
    Download Submit
  • C:\Users\Admin\Documents\ywqJGcy.exe
    Download Submit
  • memory/1204-10-0x0000000000000000-mapping.dmp
    Download
  • memory/1508-4-0x0000000000000000-mapping.dmp
    Download
  • memory/1568-9-0x0000000000000000-mapping.dmp
    Download
  • memory/1948-11-0x0000000000000000-mapping.dmp
    Download
  • memory/2348-5-0x0000000000000000-mapping.dmp
    Download
  • memory/3388-0-0x0000000000000000-mapping.dmp
    Download
  • memory/3388-3-0x0000000002200000-0x0000000002217000-memory.dmp
    Filesize

    92KB

    Download
  • memory/3612-8-0x0000000000000000-mapping.dmp
    Download