Overview

overview

10

Static

static

8

document-4...12.xls

windows7_x64

10

document-4...12.xls

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    126s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-02-2021 19:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    document-456729512.xls

  • Size

    89KB

  • MD5

    a8e0711f4830dab7290abfed3b1da8ce

  • SHA1

    9b70491a41af61bca2fb54e4f75c58fac4575d16

  • SHA256

    97999314846a57df638bb3d014c18adf19802739cc637bb68564341cc1e1ded5

  • SHA512

    d1ccb304fd4b048754eae2487109f50e70c696278f11108fac6fbb0362fa2f52ec4a0b6f38a320c0332ad051291e060a93782078a374e5c4865387a4ef82347e

Score
10/10
vmprotect

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-456729512.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\iopjvdf.vock,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\iopjvdf.vock
    MD5

    1d101557dc7b95085ba874ac4bdb38dc

    SHA1

    d92e541c707cb8825860ba8f3bf801b06fb5b0c2

    SHA256

    21249ce24600b1feac26a2a9883f3c6de299681a924be281630bc3869f0f4044

    SHA512

    31dffd6ab386d1e6df37d9aa0333c2d16b3e154d2557bf1d8bb39ae313285ae4fc463a4ed92b8a86f39ff4a624d35dfc83c1b7567e634a96e29b47347e5d6e2f

    Download Submit
  • \Users\Admin\iopjvdf.vock
    MD5

    1d101557dc7b95085ba874ac4bdb38dc

    SHA1

    d92e541c707cb8825860ba8f3bf801b06fb5b0c2

    SHA256

    21249ce24600b1feac26a2a9883f3c6de299681a924be281630bc3869f0f4044

    SHA512

    31dffd6ab386d1e6df37d9aa0333c2d16b3e154d2557bf1d8bb39ae313285ae4fc463a4ed92b8a86f39ff4a624d35dfc83c1b7567e634a96e29b47347e5d6e2f

    Download Submit
  • memory/1192-2-0x00007FFC444D0000-0x00007FFC444E0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1192-3-0x00007FFC444D0000-0x00007FFC444E0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1192-4-0x00007FFC444D0000-0x00007FFC444E0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1192-5-0x00007FFC67610000-0x00007FFC67C47000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1192-6-0x00007FFC444D0000-0x00007FFC444E0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2064-7-0x0000000000000000-mapping.dmp
    Download