Overview

overview

10

Static

static

8

Copy 7739588.xlsm

windows7_x64

10

Copy 7739588.xlsm

windows10_x64

10

Analysis

  • max time kernel
    140s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    11-03-2021 06:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Copy 7739588.xlsm

  • Size

    366KB

  • MD5

    25e9a6b92afabaadc45bf4b992560bf0

  • SHA1

    dc8c36ee7b976c59b6296482e23e15ea26e19574

  • SHA256

    6fc41047bc11f8152b3d8325985c0559514bf2b78b0aa7281babcfd280b3d9dc

  • SHA512

    67bd048fa92c639533207edf8a3dbfef7e83a4002fd5e5088502a0f276cbd1ddcfc46d2806c888bc3dfb8f77f3809991ccd62d7f2ee03e5fb0dfd14c006fb158

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Copy 7739588.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1456
  • C:\Windows\system32\wbem\wmic.exe
    wmic os get /format:"C:\Users\Admin\AppData\Roaming\2354A.xsl"
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//v23r8.dll JsRelease
      2⤵
        PID:1804

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    3
    T1082

    Query Registry

    2
    T1012

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\2354A.xsl
      MD5

      f354a093e972b7c0aeaf5d2af6f5a7bc

      SHA1

      af0cc97cdc388fb68e46079ec47618b618c8e93a

      SHA256

      6a43b095453a43f4625ef45d061f38811416bc2cafed58f5848d59b0e8e61edf

      SHA512

      6e44b3f95b0c275442b4b9afe0dcd325f5706c73a7b5adfcf88c38a86f3285a2e20d34ea6d1df00b38dfefb2b7b8c5baefa989491a860e624ec6514a083c3d17

      Download Submit
    • C:\Windows\Temp\v23r8.dll
      MD5

      0357aa49ea850b11b99d09a2479c321b

      SHA1

      41472ba5c40f61fa1c77c42cf06248f13b8785f0

      SHA256

      0ff0b7fcb090c65d0bdcb2af4bbd2c30f33356b3ce9b117186fa20391ef840a3

      SHA512

      a317a0f035b8dff7ca60c76b0b75698a3528fd4c7c5e915292c982d2b38c1c937c318362c891e93bee6fdb1b166764d7183140a837fd23daa2be3d2dac5a5dfc

      Download Submit
    • memory/1456-2-0x00007FFB33400000-0x00007FFB33410000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1456-3-0x00007FFB33400000-0x00007FFB33410000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1456-4-0x00007FFB33400000-0x00007FFB33410000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1456-5-0x00007FFB33400000-0x00007FFB33410000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1456-6-0x00007FFB59020000-0x00007FFB59657000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/1456-7-0x000002029AF10000-0x000002029AF14000-memory.dmp
      Filesize

      16KB

      Download
    • memory/1804-9-0x0000000000000000-mapping.dmp
      Download