Overview

overview

10

Static

static

8

SpaceX Sta...e.xlsm

windows7_x64

10

SpaceX Sta...e.xlsm

windows10_x64

10

Analysis

  • max time kernel
    106s
  • max time network
    108s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    08-03-2021 18:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SpaceX Starbase Invite.xlsm

  • Size

    242KB

  • MD5

    b46aa5f81d293bc7791a720b6447d01f

  • SHA1

    a8ab19110c407b6e04e460fa8bc33685868a026d

  • SHA256

    2355f05bca712ce31b1fef911395862eb34e73db7a3ca0a6bee2664024e47518

  • SHA512

    8c3b80ff99948aa1f67ed9b6a9c5b2b1225b9246b71b7a8f97661bd054339f67e82aa7f118fed8462ce20ff1a58d9f07cb07c91f1220ac48d8fd1502f1be1e93

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\SpaceX Starbase Invite.xlsm"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1968
  • C:\Windows\system32\wbem\wmic.exe
    wmic os get /format:"C:\Users\Admin\AppData\Roaming\1DF1C.xsl"
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//499oz.dll ValidateLog
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//499oz.dll ValidateLog
        3⤵
          PID:1868

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\1DF1C.xsl
      MD5

      ea71d43dea5ac0a4f1687d4b4c0f7a73

      SHA1

      06abfa510041b5eadaaad4aed4a196eca63f475a

      SHA256

      9aecdb029868fb446bad577f10695472497bb2bfe87d30b3ef13da834742efaa

      SHA512

      7e597efd1045738621da21c0972f46f360fe13d9988085fc29b479bb73d7de0506d6eef396eca1e6526505b5874760eaa73c1e09fcd149846306edd5bd73a40f

      Download Submit
    • C:\Windows\Temp\499oz.dll
      MD5

      e6461c56f94b7429a38c7580061fc773

      SHA1

      363f5740d573d8b60c8918219460385de934a01e

      SHA256

      29829fa9b123af5c418e3c2f40c4087fc8b4b17e66c9f632378ad061b0d60390

      SHA512

      d298c11acdbef761e308d0e64cd0617223ccfe9746f1a2a1020068071d3491e3ae4e24a5d6cf078a8371396912bcb6c4e236a37d5400902cb976d2ea21da5893

      Download Submit
    • memory/776-7-0x000007FEF5E90000-0x000007FEF610A000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/1868-10-0x0000000000000000-mapping.dmp
      Download
    • memory/1868-11-0x0000000075ED1000-0x0000000075ED3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1968-2-0x000000002FD71000-0x000000002FD74000-memory.dmp
      Filesize

      12KB

      Download
    • memory/1968-3-0x0000000071031000-0x0000000071033000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1968-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1968-5-0x00000000059E0000-0x00000000059E2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/2024-8-0x0000000000000000-mapping.dmp
      Download