Analysis
-
max time kernel
27s -
max time network
16s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-03-2021 09:00
Behavioral task
behavioral1
Sample
Debt-Details-1388003497-03052021.xls
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Debt-Details-1388003497-03052021.xls
-
Size
78KB
-
MD5
12a5851cea8f81ec1b5deebc5ccfc6c2
-
SHA1
148282ad98eb4aae63030f7b85581ed8d9cdf99e
-
SHA256
2dba3900155f3c89031fbce6b06fd8bf85f066a3e12b8f4a0b6142f5150befa4
-
SHA512
60d2f8867669919aa68195e2c3d36ffa1ae06c3435ebd50059f64757ab1544b4a8fb356ff66bd7fd13fa5bc70bce02d675307a3ca319bcd7661fb3763f171e77
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2088 4756 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 580 4756 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 668 4756 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 876 4756 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 380 4756 rundll32.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4756 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4756 EXCEL.EXE 4756 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
EXCEL.EXEpid process 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 4756 wrote to memory of 2088 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 2088 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 580 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 580 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 668 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 668 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 876 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 876 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 380 4756 EXCEL.EXE rundll32.exe PID 4756 wrote to memory of 380 4756 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Debt-Details-1388003497-03052021.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr1,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr2,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr3,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr4,DllRegisterServer2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/380-12-0x0000000000000000-mapping.dmp
-
memory/580-9-0x0000000000000000-mapping.dmp
-
memory/668-10-0x0000000000000000-mapping.dmp
-
memory/876-11-0x0000000000000000-mapping.dmp
-
memory/2088-8-0x0000000000000000-mapping.dmp
-
memory/4756-2-0x00007FFACA170000-0x00007FFACA180000-memory.dmpFilesize
64KB
-
memory/4756-3-0x00007FFACA170000-0x00007FFACA180000-memory.dmpFilesize
64KB
-
memory/4756-4-0x00007FFACA170000-0x00007FFACA180000-memory.dmpFilesize
64KB
-
memory/4756-5-0x00007FFAEE190000-0x00007FFAEE7C7000-memory.dmpFilesize
6.2MB
-
memory/4756-6-0x00007FFACA170000-0x00007FFACA180000-memory.dmpFilesize
64KB
-
memory/4756-7-0x00007FFAC6660000-0x00007FFAC6670000-memory.dmpFilesize
64KB