Overview

overview

8

Static

static

MT Caribe ...8.xlsx

windows7_x64

8

MT Caribe ...8.xlsx

windows10_x64

1

Analysis

  • max time kernel
    147s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    13-07-2020 05:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MT Caribe Angela_Q88.xlsx

  • Size

    179KB

  • MD5

    1b402debe2be6e5bf91e932a8f0c9886

  • SHA1

    3d3053788758dcb747a49b20489cde5cec64a3ea

  • SHA256

    5e2759a3bbbbf9e8cd16ece86e9fafe5495810e798bbb355af61eb4ec175cae5

  • SHA512

    20d9137b2e0d709abbb7edb478a4c3c84817c652d3b40ca4e492aae663ba502cf03bf916fde5aea1056e3591e9cc93f29ec3d71d907ff1e2da5af78153a6e886

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\MT Caribe Angela_Q88.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    PID:3768
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3888

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4
      Download Submit
    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4
      Download Submit
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4FFTI156\invoice_214744[1].doc
      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\.ses
      Download Submit
    • memory/3888-1-0x0000000000000000-mapping.dmp
      Download