Overview

overview

10

Static

static

10

document-1...43.xls

windows7_x64

10

document-1...43.xls

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    06-03-2021 03:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    document-1557878943.xls

  • Size

    39KB

  • MD5

    859443784b857b985a2656c8ef8b585e

  • SHA1

    46c83701b4204d1a1a7acac46aa81eb200f89b6e

  • SHA256

    1b6fba5ecc7453ff21ea5162ec52e5af180de5b14d4f7ac7f976d56f93c5e84a

  • SHA512

    9684ae131110bcac95618e605dc3579d766c855f990f54129059d8f441e4b9bcc818faf8b5805af01894361b96bf990d5965d96c61283b15c431abeea3f8554f

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1557878943.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\fkruf.djr,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:3156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1908-2-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1908-3-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1908-4-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1908-5-0x00007FFCA0D80000-0x00007FFCA13B7000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1908-6-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3156-7-0x0000000000000000-mapping.dmp
    Download