Analysis

  • max time kernel
    70s
  • max time network
    57s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    04-03-2021 18:33

General

  • Target

    Overdue-Debt-772042115-03042021.xls

  • Size

    76KB

  • MD5

    c46749fcc94a9ef242decd71824ff574

  • SHA1

    c85af3ed52f440ac6a34210c750abd89a0293002

  • SHA256

    892ed46d45d0621077da3dcc22b3c3b7a1e285b75982974194d5ddc49251cba2

  • SHA512

    79b3ce826d2773af1c26cfb3c978a4ecaff13bb0851fda33c15b09a09b5d965ed14619406111b5a6494f4fbd35711a57bce568941414ba024ec9b4e5fbffda08

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://giftcard16.com/ozdomsmm/44259.7709361111.jpg

Signatures

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Overdue-Debt-772042115-03042021.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1152-5-0x000007FEF6380000-0x000007FEF65FA000-memory.dmp
    Filesize

    2.5MB

  • memory/1636-2-0x000000002FBC1000-0x000000002FBC4000-memory.dmp
    Filesize

    12KB

  • memory/1636-3-0x0000000071521000-0x0000000071523000-memory.dmp
    Filesize

    8KB

  • memory/1636-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB