Overview

overview

10

Static

static

8

Invoice 7739588.xlsm

windows7_x64

10

Invoice 7739588.xlsm

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-03-2021 12:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice 7739588.xlsm

  • Size

    208KB

  • MD5

    18bda253da854f2ee726961804cb1d81

  • SHA1

    681ce3158dafcc760c247753dfa449e38935275c

  • SHA256

    e54e2798f937775cf8e763c8a57ad5401c273bb4dc5893302796937658762e4c

  • SHA512

    844adfec03231c29e36a3eb827a430d058f488cce5fe0c0ad9ba5d74205718d0891eadedd0208cec418ccbe0daace2b205b495bb6128bf06579841e7c94958bb

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Invoice 7739588.xlsm"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:532
  • C:\Windows\system32\wbem\wmic.exe
    wmic os get /format:"C:\Users\Admin\AppData\Roaming\28BF0.xsl"
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:524
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//ncrz7.dll JsRelease
      2⤵
        PID:1900

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\28BF0.xsl
      MD5

      63545b68e9fd6687e07dab16098cd7b0

      SHA1

      0dcb7d7062b932f28463def7175edd45652f2614

      SHA256

      a35781e3e5367c1ad05fdb7049d2485c70a9259910024310486e9f12c386abae

      SHA512

      502b6715af0cc31c81d9ecdd099d553330d503972dd13e56e4e3f57ecf4f2ec792b21252eb0f48bffefeb059b838a402b1abc7496b789e05ec31068fb4621e25

      Download Submit
    • C:\Windows\Temp\ncrz7.dll
      MD5

      bee1ee6996b9cc7c9ceba083211a48a5

      SHA1

      b1d6aa8c1831b5462da7d031b022e639e4dd1c3f

      SHA256

      0eb0d960a45560a0c1752bbe6b69889bf6b24fd48db76914c41ceb4f9d3b11a7

      SHA512

      ead63b541795a79d708540a11db35ffb50081aa08a8a72a727f10a37e465ae1929a8a8bc80fb528dcccf62085343b52e115f1307c252c39e3f2f9e2f2c374f7b

      Download Submit
    • memory/532-2-0x000000002F191000-0x000000002F194000-memory.dmp
      Filesize

      12KB

      Download
    • memory/532-3-0x0000000070FA1000-0x0000000070FA3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/532-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/532-5-0x0000000005B10000-0x0000000005B12000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1508-7-0x000007FEF7040000-0x000007FEF72BA000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/1900-8-0x0000000000000000-mapping.dmp
      Download