Overview

overview

8

Static

static

8

39831.xls

windows7_x64

1

39831.xls

windows10_x64

1

Resubmissions

04-03-2021 08:52

210304-j75tzr3r6n 8

04-03-2021 08:48

210304-m8yqkl1awa 8

04-03-2021 08:46

210304-bb9saj67xx 8

04-03-2021 08:07

210304-s65gytp48n 8

04-03-2021 08:00

210304-s4fe9phywa 8

04-03-2021 07:58

210304-7fges7mren 8

01-03-2021 22:43

210301-7y8wr7t7jj 8

01-03-2021 22:40

210301-nyl6dpb96e 8

01-03-2021 21:40

210301-qmk2grykva 10

01-03-2021 16:58

210301-2aqemcsxcn 8

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    04-03-2021 08:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39831.xls

  • Size

    58KB

  • MD5

    b5487815da8e8e15cfa3d2946f4b7132

  • SHA1

    3278e15e1761100b6e9bb98b2351594aebd3805d

  • SHA256

    409c0fdd23e87d2181aed6a283d83cdeaa1b7fbb685df01b5358febb0d09c8b8

  • SHA512

    8f70813984c0e10b37cc6f256d30dbc9648a07124e0771ba8d701f2eb3457fa57a19105ace52adb3b9e32ee9aaf6272e6fea32c00b1374fb54e1c984832d22c0

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 56 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\39831.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3248
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /7
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1816
  • \??\c:\windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:1088
    • \??\c:\windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:396
      • \??\c:\windows\system32\sihost.exe
        sihost.exe
        1⤵
          PID:3344
        • \??\c:\windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:1428
          • \??\c:\windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:2360
            • \??\c:\windows\system32\sihost.exe
              sihost.exe
              1⤵
                PID:2500

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              Privilege Escalation

              Defense Evasion

              Credential Access

              Discovery

              Query Registry

              3
              T1012

              Peripheral Device Discovery

              1
              T1120

              System Information Discovery

              3
              T1082

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/3248-2-0x00007FF7FC7D0000-0x00007FF7FC7E0000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3248-3-0x00007FF7FC7D0000-0x00007FF7FC7E0000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3248-4-0x00007FF7FC7D0000-0x00007FF7FC7E0000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3248-5-0x00007FF7FC7D0000-0x00007FF7FC7E0000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3248-6-0x00007FF81FB70000-0x00007FF8201A7000-memory.dmp
                Filesize

                6.2MB

                Download