Overview

overview

10

Static

static

8

428E1ABAB6...86.xls

windows7_x64

10

428E1ABAB6...86.xls

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    20-01-2021 18:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    428E1ABAB62B190787DB4A57D19CCF86.xls

  • Size

    799KB

  • MD5

    428e1abab62b190787db4a57d19ccf86

  • SHA1

    b443cbc0b74ac39f696585f99160ddb5bfdc1e3a

  • SHA256

    5548251bf7e67b8dfa368d5b1e6699d9f260324e419d3e530c1d5ea927e3aaf2

  • SHA512

    3988a34186641af8c65feb0a0938eeee5d849fc3df0b93d82fa7f9b44527f17dd714dd0e2539058691fbbf48f0d72469acdb597ea2e4233192f4a8f936ef9d3b

Score
10/10
ransomware

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\428E1ABAB62B190787DB4A57D19CCF86.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:276
  • C:\Windows\system32\wbem\wmiC.exe
    wmiC
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//9d2ef.dll InitHelperDll
      2⤵
        PID:664

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\2553F.xsL
      MD5

      5cdd36af549532a525403c3bf0a197e3

      SHA1

      37f4135a3883580001c1bb777e423618386f27bc

      SHA256

      ad49647554d461875b482b64e08c02fe47c4f0d2dcbdf84560a0be690dd803a4

      SHA512

      3c783d943b8935cf6851fc738243526fc909af3b0515b1188d2edbfcc2bebad556f7b6fa74bff8403e45edea274a62c7a9ee466e9415842f54e3f6317b4d11f9

      Download Submit
    • C:\Windows\Temp\9d2ef.dll
      MD5

      b73d09e9ad4a4132a00240a15739a078

      SHA1

      57e60b13c7945b008f615bea543da3bd9e64a085

      SHA256

      8c0e184d7769ea6e335f8b197989377deaa698987dda8d3cbcbde2a973b4e488

      SHA512

      e3044516cde3c3ef3c40b99b2f2d85bc4d2e4bf501114595fb96c7cea1d06b4343791687ecf6f69be28b812868499b4d525afc6dad3d831ae7d360af53ed03d2

      Download Submit
    • memory/276-2-0x000000002F061000-0x000000002F064000-memory.dmp
      Filesize

      12KB

      Download
    • memory/276-3-0x00000000715E1000-0x00000000715E3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/276-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/276-5-0x00000000062A0000-0x00000000062A2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/572-7-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/664-8-0x0000000000000000-mapping.dmp
      Download