Overview

overview

10

Static

static

8

666f323aaa...2.xlsm

windows7_x64

10

666f323aaa...2.xlsm

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    03-03-2021 19:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    666f323aaaeb3ad7c537561f66d74132.xlsm

  • Size

    187KB

  • MD5

    666f323aaaeb3ad7c537561f66d74132

  • SHA1

    478f0bb55cef539818bffde3dc7f3175c29bf2cb

  • SHA256

    7f322b2e240f3dfc09f4be7d9cbc806feb902587fbba27520d4d8641c6fa683c

  • SHA512

    2caad2f2a45683475637dc331016be9ac642ea3119f7265d6d76a6994153ce88e14ba9985664231c3e48e0f52f94a6506f90d1ce4ea800dfc7e6e056596955ac

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\666f323aaaeb3ad7c537561f66d74132.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:360
  • C:\Windows\system32\wbem\wmic.exe
    wmic os get /format:"C:\Users\Admin\AppData\Roaming\27041.xsl"
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//hivjg.dll RunXml
      2⤵
        PID:1612

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\27041.xsl
      MD5

      6e5e3a0f3b3e45d2b8aa4872750a5b21

      SHA1

      43322560fb8685b61946dd7dc7e2ab8bc6522807

      SHA256

      4679aecd0ebdca18aecc3df289e29557ad36e8530cae3628a5de5985f43d808d

      SHA512

      0d0d017983dbb1e4def10ffc465416bead0be6af556eae45859e14390a646449f3b3e7069588393f4747409e7abc38a2804dd93846e7351b1bfab5209f38e260

      Download Submit

    • C:\Windows\Temp\hivjg.dll
      MD5

      ce6fc6e7c5dd17d711206d792d38093d

      SHA1

      95bd6754201e7f787d9314a3179c4ed64d5fffc2

      SHA256

      0b4fd36e512c350b28d45964d689a538c4325aa3d16ea089f8f61733fab27d77

      SHA512

      94f42951981fdec54149b10c89666505343e0b2a7f792a2fde663b886af40f58e9286f1fba24d2a64ae35331e2302f4c7f26cb0ebb48eca60206cc74be81084a

      Download Submit

    • memory/360-2-0x000000002F651000-0x000000002F654000-memory.dmp

      Filesize

      12KB

      Download

    • memory/360-3-0x0000000071191000-0x0000000071193000-memory.dmp

      Filesize

      8KB

      Download

    • memory/360-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/360-5-0x00000000059C0000-0x00000000059C2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1324-7-0x000007FEF6010000-0x000007FEF628A000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/1612-8-0x0000000000000000-mapping.dmp

      Download