Overview

overview

10

Static

static

8

Document10...21.xls

windows7_x64

10

Document10...21.xls

windows10_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-02-2021 20:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document1094680387_02012021.xls

  • Size

    63KB

  • MD5

    9423ee9775707d51960e0eac95b3f6cc

  • SHA1

    debc0defc997fde77a2f0cee9b3b1fcbed54ea91

  • SHA256

    7034e21128da9ce58c2d5249d3fd73dd766cf90437fa52f79faa50098f359634

  • SHA512

    0cff3519c5453bdeb13201849c571cbb142ed6780c2e6cae572104904af1190ff4d4e068ff0109953745b153fc219c618519318cadd4dcac300b3d280643bc53

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Document1094680387_02012021.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\MORI.BAST,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\MORI.BAST
    MD5

    408148c0b7622e35f82754abad0956a7

    SHA1

    56e332a3f511c33c7c8a28ad83adbd2a9d57c6b5

    SHA256

    b00b60b405caad2bb84ee6e62f6acc35a13dedabc21a9971d4bad934ff94a443

    SHA512

    ee225f4919eba53264ef9a939ac443219b881a21b789b67a1df5410fca4a632cf4a20445ed2d8f428b14c6b99391771c8dc6bb8128f75742bcc62d75298d4565

    Download Submit
  • memory/796-7-0x0000000000000000-mapping.dmp
    Download
  • memory/4688-2-0x00007FFCCE2C0000-0x00007FFCCE2D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4688-3-0x00007FFCCE2C0000-0x00007FFCCE2D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4688-4-0x00007FFCCE2C0000-0x00007FFCCE2D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4688-5-0x00007FFCCE2C0000-0x00007FFCCE2D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4688-6-0x00007FFCF1760000-0x00007FFCF1D97000-memory.dmp
    Filesize

    6.2MB

    Download