Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    11-03-2021 12:32

General

  • Target

    sample.xls

  • Size

    276KB

  • MD5

    5cd0bfc13e54454404bdea0a16d5fbba

  • SHA1

    c191aeed68de9ebcbd8cf14aa4d6465e305e6603

  • SHA256

    d54fa3d2b17706fe6e4c1159c04ff2bbc4f2403de5855f73a038ed8335e7e3f2

  • SHA512

    cee9509a75a51f740ad087b4af2116b2644999aabbbea2281efc90ec298786f66ba4a211c3a83b6e0a7a6d6c3fcfa51e146d3fc19683c5f302fc52c132fe014d

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 5 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\sample.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\Runtime.brok,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:2336
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\Runtime.brok1,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:2440
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\Runtime.brok2,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:760
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\Runtime.brok3,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:2660
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\Runtime.brok4,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:1816

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Runtime.brok1

    MD5

    153665460fe2578e8dc4e36ef7077d80

    SHA1

    40a90b6f98c358bdbdd6e5842c186d919cdde7e3

    SHA256

    3ad4b3ff863a1ff41ea1e6ebb34f374a8d54804ec27b5531d05e579374bd602b

    SHA512

    31abced5777e4c5dd3f155fbda068ab786a57e0d24cb535d41379c471011a6ac757f2ad4802c52249b3280065c4ce31e3a7f932637d8ee37adbccdab3a2bf2f8

  • memory/540-2-0x00007FF983B50000-0x00007FF983B60000-memory.dmp

    Filesize

    64KB

  • memory/540-3-0x00007FF983B50000-0x00007FF983B60000-memory.dmp

    Filesize

    64KB

  • memory/540-4-0x00007FF983B50000-0x00007FF983B60000-memory.dmp

    Filesize

    64KB

  • memory/540-5-0x00007FF983B50000-0x00007FF983B60000-memory.dmp

    Filesize

    64KB

  • memory/540-6-0x00007FF9A7100000-0x00007FF9A7737000-memory.dmp

    Filesize

    6.2MB

  • memory/760-10-0x0000000000000000-mapping.dmp

  • memory/1816-12-0x0000000000000000-mapping.dmp

  • memory/2336-7-0x0000000000000000-mapping.dmp

  • memory/2440-8-0x0000000000000000-mapping.dmp

  • memory/2660-11-0x0000000000000000-mapping.dmp