Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-02-2021 09:16
Behavioral task
behavioral1
Sample
Invoice_0565943.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Invoice_0565943.xls
Resource
win10v20201028
General
-
Target
Invoice_0565943.xls
-
Size
266KB
-
MD5
f6af4458d269a660cedc88ff8738d4ce
-
SHA1
d7350d7195c73a9489b3c27d62407e2c8f34825d
-
SHA256
05b0a29f16f196a36944c94487032c1d9b9acc6bee8839457d730f4053f68e29
-
SHA512
b24c6105017b8cb0f90c45e6c89838ae58521b285750a3f315ad80dc15a422ca41bab69ca87fa80aaef2901c60f186351bf09022872880c8ed9112a97817dd0c
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1312 496 regsvr32.exe EXCEL.EXE -
Processes:
resource yara_rule C:\ProgramData\msversion.dll vmprotect \ProgramData\msversion.dll vmprotect -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1344 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 496 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
EXCEL.EXEpid process 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE 496 EXCEL.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
EXCEL.EXEregsvr32.exedescription pid process target process PID 496 wrote to memory of 1312 496 EXCEL.EXE regsvr32.exe PID 496 wrote to memory of 1312 496 EXCEL.EXE regsvr32.exe PID 1312 wrote to memory of 1344 1312 regsvr32.exe regsvr32.exe PID 1312 wrote to memory of 1344 1312 regsvr32.exe regsvr32.exe PID 1312 wrote to memory of 1344 1312 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice_0565943.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\ProgramData\msversion.dll2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\ProgramData\msversion.dll3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\msversion.dllMD5
e23246d5a16fd344dfd2fc7177d43890
SHA19d0ee3d8896911c2743ff89c72c30639f0851f52
SHA256f4f02f78b8d89ed5063773985d4ad7b4c9205417b34787fb945f739134a85a8b
SHA51201d4b4c0c60272759906f3c2d255a0378c9b4c081878866c9beef187a8c58b53d7da50109541f2da3051035e72b7a60b54710d6e3cddd01a28eb1009bc6af1ed
-
\ProgramData\msversion.dllMD5
e23246d5a16fd344dfd2fc7177d43890
SHA19d0ee3d8896911c2743ff89c72c30639f0851f52
SHA256f4f02f78b8d89ed5063773985d4ad7b4c9205417b34787fb945f739134a85a8b
SHA51201d4b4c0c60272759906f3c2d255a0378c9b4c081878866c9beef187a8c58b53d7da50109541f2da3051035e72b7a60b54710d6e3cddd01a28eb1009bc6af1ed
-
memory/496-2-0x00007FF7E5FB0000-0x00007FF7E5FC0000-memory.dmpFilesize
64KB
-
memory/496-3-0x00007FF7E5FB0000-0x00007FF7E5FC0000-memory.dmpFilesize
64KB
-
memory/496-4-0x00007FF7E5FB0000-0x00007FF7E5FC0000-memory.dmpFilesize
64KB
-
memory/496-5-0x00007FF7E5FB0000-0x00007FF7E5FC0000-memory.dmpFilesize
64KB
-
memory/496-6-0x00007FF8091A0000-0x00007FF8097D7000-memory.dmpFilesize
6.2MB
-
memory/1312-7-0x0000000000000000-mapping.dmp
-
memory/1344-9-0x0000000000000000-mapping.dmp