Overview

overview

10

Static

static

8

inv_8.xls

windows7_x64

6

inv_8.xls

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    126s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    17/07/2020, 08:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    inv_8.xls

  • Size

    603KB

  • MD5

    37f53b3c355374800e2766f86a4fb029

  • SHA1

    4bc459dad806e86dcedb183e60ba891e20d0bea7

  • SHA256

    a4c76c4969af9211c5ae6e6d0942971b0b7b4e0fb2a4b47e45e77231ea22a5ab

  • SHA512

    d9e0ee28afa96f4ca897f9a2c7f6248ee83decf11777e91302b0b0481a00e51963b14802f1f36618dd7c3def10020877ff5c2942249154c3011887da7d95a6fa

Score
10/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of WriteProcessMemory 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\inv_8.xls"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of WriteProcessMemory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:3788
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /i CztMJfC.ocx
      2⤵
      • Process spawned unexpected child process
      PID:3144

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads