Analysis

  • max time kernel
    75s
  • max time network
    28s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    26-11-2020 16:03

General

  • Target

    document-1502812177.xls

  • Size

    331KB

  • MD5

    3fe1a7ebb1d2f45ca2832f3be1e9742a

  • SHA1

    a8febe2ab12238f693f0c4323b23e853fd5cf001

  • SHA256

    af653cf24e72f8b17eb0faa331ce540ed7cc4c602dfd73380e7f63493d6b2158

  • SHA512

    3386aab35156754f86bce68096ecf25947f077aec7f72974a1edccf3486ed22908c4daa0c74874deeee673bb78a6db65aa4985b5277e5693f38a1f3df23fb480

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\document-1502812177.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll
      2⤵
      • Process spawned unexpected child process
      PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1328-2-0x000007FEF7570000-0x000007FEF77EA000-memory.dmp
    Filesize

    2.5MB

  • memory/1708-3-0x0000000000000000-mapping.dmp