Overview

overview

8

Static

static

8

Doc_3744.xls

windows7_x64

1

Doc_3744.xls

windows10_x64

7

Resubmissions

28-02-2021 17:05

210228-pjgnbjwth2 8

27-02-2021 12:13

210227-bpkha5za7s 8

27-02-2021 04:19

210227-7c1xkzg346 10

27-02-2021 03:32

210227-2xwvzgykxs 8

27-02-2021 03:29

210227-qgrlcph782 8

27-02-2021 03:16

210227-k82qfdjlve 8

27-02-2021 02:45

210227-mjxh7bv4wj 8

27-02-2021 02:23

210227-w6qfkjy5ha 8

27-02-2021 02:06

210227-r385kvgs32 8

26-02-2021 23:10

210226-yds8gthfax 8

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    27-02-2021 03:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Doc_3744.xls

  • Size

    62KB

  • MD5

    47e22049644647ee854cedfe077156e7

  • SHA1

    20ad9f47616a8272dece2ec1039a88c09412c97c

  • SHA256

    5f2adacaf4ecb00ed24dd9dfe355307d0d6e786e40c945ad4c6d1ae3a4835d2a

  • SHA512

    1eeb87173378f4d0e157ee42f5b28e48ff84a35b44d71f004a6180cc2bdbc09e45c071adc7ab0a94c75071fbe3ee13b939ee8cb216b6f2e06c9c24ca34dbbf1b

Score
7/10
spyware

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 34 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Doc_3744.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4696
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    1⤵
      PID:804
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4420
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4420 CREDAT:82945 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4588
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:3340

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        MD5

        645278e32992298d7366e4e0ac9a360d

        SHA1

        14aa557d892ebdf5337e91b9b9ea8ba4e1ea7e50

        SHA256

        69f5ccba9de478a6e724aa9f26765151fa78b096ede32f599945cb192f61c1b4

        SHA512

        9b5922ca42eccbe5808ee4952e8978e6ec8d819db4a63f9283f560fea54bd01ad51dfc146e1238a067f45b5bfd3603fe43e81b850f35833a836d015c7720e024

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E706EC2EDE247F030D73F5CDF441F029
        MD5

        3f907f4f6daf01ee4aadb84f67210fc2

        SHA1

        12aa2a28de53dc2fc2f51bcbfa024d903d8aa369

        SHA256

        4c3b51b2b505c59d6d3ce7072663548cee68f1740351c80d19a887841056cf8e

        SHA512

        8ca32b9ec658ac93897ed2e19e246b3b7981e5b70454f5deb27cdff2185feec552a99653d0b32b2e303456866971459f2d429498f89e35856572ce7b0a286611

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        MD5

        9ccae07ea652bbc191b17d6f18fe2904

        SHA1

        4a4cf3b91da983837fba977cb17cc27cba579313

        SHA256

        db885b60999f45f206abcc46b8b88b935501d75327d6ef7ae7493390744f39c6

        SHA512

        e4f84e537d27c1f02585754072494a566aefff3a1fb42b1891028b2db8549b7bb4fb146bb0608e59e2e7f0e94c8c631ce647fb310b68b5364711203f5185a47c

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E706EC2EDE247F030D73F5CDF441F029
        MD5

        9e78ec97966868e08bdba9a4d2b94da7

        SHA1

        5fdf1d1e816e30cd86a89840859309de875abc95

        SHA256

        95c981b9a91d0d9468d16c25ea0432b14cb878a4f1ecae4fe14d6b502699305e

        SHA512

        b09f7f70103ff4ba4b6aa050d5643ee6502407905aaa2f0610f319217f448fd57ffe3e68444148bd3a1daf81bed15e3c08c1a1c8de4062f7d4b89e687a79410c

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\OGDR532A.cookie
        MD5

        25a2a923cf793e04d3652f4441295e0f

        SHA1

        f3303b92484eb909f9a0123649cf2c3a3b5a0ef9

        SHA256

        42f6c33a97fad0b9b01465741eec1509c0bc1204683777b469984ab29fcd13a1

        SHA512

        12dee9d68bcceec2776f8645901ab5d5fef4502f27dc3c6bd63222957ff051c81044c8800e754ad4b7239a9e1e8ee532ee0a209814ea5f5b959b31f67c74fb53

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\P0S3DN67.cookie
        MD5

        9b0f54aa485ddc7e4307ad6ccb126cca

        SHA1

        86b0f6b7e6dcbb656477f9dbbcd44de3084b6b5b

        SHA256

        c88c40d4bd9077a6a59ea7d7b7371a739dd13c4e11f75b9a95cb3b0cb9368af4

        SHA512

        0c453c4ddaa9960b7b68fb0f5b08325e92a93ea9d530de550d4ffebfdad1c7ce97409ef7a7e78074f6be9bacafc298cef9b1de02f4d8788d666552fdc8fed445

        Download Submit
      • C:\dir10.txt
        MD5

        7a9d4d58cf6c2d77a5bb63282708b902

        SHA1

        d5122c8f73de2c8169da15ed439897178ea7dad2

        SHA256

        a8346473b5ab0514f1c38bcf40e5dfa8a82107bb27d5e8b0d6f3253ce3f23d03

        SHA512

        da0af53c1d5a0983d7ea2417bde1df9b8ee827ff651a71c79781fcf304953a762149bfe13aa3daacb6eba8d74e264409c7e762141a5d8cc78dd41b032646b0b5

        Download Submit
      • memory/4588-7-0x0000000000000000-mapping.dmp
        Download
      • memory/4696-6-0x00007FFCCE2C0000-0x00007FFCCE2D0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4696-5-0x00007FFCF0B70000-0x00007FFCF11A7000-memory.dmp
        Filesize

        6.2MB

        Download
      • memory/4696-4-0x00007FFCCE2C0000-0x00007FFCCE2D0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4696-3-0x00007FFCCE2C0000-0x00007FFCCE2D0000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4696-2-0x00007FFCCE2C0000-0x00007FFCCE2D0000-memory.dmp
        Filesize

        64KB

        Download