Overview

overview

10

Static

static

8

Copy 7739588.xlsm

windows7_x64

10

Copy 7739588.xlsm

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    11-03-2021 06:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Copy 7739588.xlsm

  • Size

    201KB

  • MD5

    afb5ae0f3a9992fdd329d5353d5faf3d

  • SHA1

    f7900c280982426cf5b69c56500e5c1a3bfa3149

  • SHA256

    5b029d35e3b26016449753fa274b30071f7e7857b0f07af97d9d0dfed828e581

  • SHA512

    8d030af621f5d0370daf98912b69a88f353f8e7e6676a760cf66e6b927aa783dc124f9ad67ef2b103f1a105fe1f4c861ab57971e274072607466ef449c0e8a43

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Copy 7739588.xlsm"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:792
  • C:\Windows\system32\wbem\wmic.exe
    wmic os get /format:"C:\Users\Admin\AppData\Roaming\45CF7.xsl"
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:480
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//0te73.dll JsRelease
      2⤵
        PID:284

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\45CF7.xsl
      MD5

      ff781c740c3cd774b3013d7a6c542dde

      SHA1

      e0066536e248f9b3d61abf28992d2b18f2bfb34e

      SHA256

      5c89f380540741e7b95d594a1c42ed7871ed5bc52aa13c87ff98a79eed4275ea

      SHA512

      bec8957a04f548e46fe4c05f2509edc02e4142b97a6200f9d5cbf9e76306e34ab6be17cd13aba6da9183679480264c413e70244070621ae5ff23a1b85e964507

      Download Submit
    • C:\Windows\Temp\0te73.dll
      MD5

      3c1d76e4abf070a1ab66856f1619077c

      SHA1

      99ab8f961e03303598c8f0b5613b1431fe09616f

      SHA256

      3243890204efff55a19084bc6c3257f3b8e9fee6a992bca8f48b6be7e5e6e01c

      SHA512

      4bfc8be081fc08ae21a75c74d111a77e0b0e61155c12becd4de935e575710922d0953508c756c21f3dc6944ec548f0ab897bf32c6894a89addef3a23953d51da

      Download Submit
    • memory/284-8-0x0000000000000000-mapping.dmp
      Download
    • memory/792-2-0x000000002FA71000-0x000000002FA74000-memory.dmp
      Filesize

      12KB

      Download
    • memory/792-3-0x0000000071CE1000-0x0000000071CE3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/792-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/792-5-0x0000000005B50000-0x0000000005B52000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1488-7-0x000007FEF7EB0000-0x000007FEF812A000-memory.dmp
      Filesize

      2.5MB

      Download