Overview

overview

10

Static

static

8

Reports_6633.xls

windows7_x64

10

Reports_6633.xls

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-01-2021 07:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Reports_6633.xls

  • Size

    797KB

  • MD5

    70582dd298a2785233bdc58ef6ebf124

  • SHA1

    385ab29a95d5bd46981a3d4b11fe42c2c50059ae

  • SHA256

    861f0ff89dfec337fe08a17a305020ef1b7d27efb4c367793138561020cd93f8

  • SHA512

    d3f692e868cc0990d518a587a474747c286e97fec06960d0a9f088d8741f7e0592105450836c282583c5dc6bc2a60fbfd17034ffa0c1988633b27a103fab9b73

Score
10/10
ransomware

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • JavaScript code in executable 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Reports_6633.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1944
  • C:\Windows\system32\wbem\wmic.exe
    wmic
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//y9rxn.dll InitHelperDll
      2⤵
        PID:1556

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\250E7.XsL
      MD5

      a4abedbfce3ec5bd1bdd0d68774d6055

      SHA1

      d65614acfa4d3d7291a3e46338aa81de61f68fc2

      SHA256

      9a8d8e2337d10f62659026d47abb3556c1093954536a826c1803cc1a67a37b45

      SHA512

      96d1797143fbc557b2d3517eea899ce33283d9d47f1ad35a82cc9caa1452e2ec64a7e3d00463ef9b3c8235fa96b237453cfc383b5e9cc5b4ab720160eabdeee5

      Download Submit
    • C:\Windows\Temp\y9rxn.dll
      MD5

      b155b85dfb3af8d7c70d7661112c3c69

      SHA1

      398204de26e46aae6041a57028db15de26b0f794

      SHA256

      f0b1f5a515475c7460305147a8aac89980817a8e8e844764d6d479d16ffd1df4

      SHA512

      805eb0c2f9e6bbb69e087b2a4f5a6de0872e851ce09c1c8e0737e7f3b8ae0f441c3ef6e6e668a9995aaf61275053c857ff07394ccba45deaa8993626ff3b13cd

      Download Submit
    • memory/1340-3-0x000007FEF5FA0000-0x000007FEF621A000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/1556-4-0x0000000000000000-mapping.dmp
      Download