Overview

overview

10

Static

static

8

SecuriteIn...9.xlsm

windows7_x64

10

SecuriteIn...9.xlsm

windows10_x64

10

Analysis

  • max time kernel
    122s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    21-04-2021 23:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Heur.10624.9849.xlsm

  • Size

    144KB

  • MD5

    060d95988fc565133a252aadc91ea24f

  • SHA1

    59a2f22c0c6622b2074f2fa59a1136b430aaffb3

  • SHA256

    b6430f1c70dd393e02aadb47cb51716844f13bc53dc5258887d6c257a01c5563

  • SHA512

    d178fac514d78d334271fe28ba0c92be8cbfbb4240ce1e725effb0458e28f259e3a2b6983e46f7a17e4fd1a862e9a99e8f1061983057e10dd2dc6f479782155f

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.10624.9849.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\27894..dll" JsVarAddRef
      2⤵
      • Process spawned unexpected child process
      PID:3832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\27894..dll
    MD5

    3de33f7b265968439dd78b4804e8453f

    SHA1

    6f3e2c59425a5c8c6c69a6f3f96005c591b8261a

    SHA256

    5e00d802ef288fa7c0e04adb4b901186b1f12fbf21065d02af6eed923e7e3275

    SHA512

    0cdd21f734f2271aae3dffcdb9484488ec4beb48839cda2071ed7b6483cdd217eb95ec0b319d94b3082982accc2028f76a54d5fd23b4fad739db38ebb9ec7853

    Download Submit
  • memory/656-114-0x00007FF6231C0000-0x00007FF626776000-memory.dmp
    Filesize

    53.7MB

    Download
  • memory/656-115-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-116-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-117-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-118-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-121-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/656-122-0x00007FFDBFCB0000-0x00007FFDC0D9E000-memory.dmp
    Filesize

    16.9MB

    Download
  • memory/656-123-0x0000019F1A4B0000-0x0000019F1C3A5000-memory.dmp
    Filesize

    31.0MB

    Download
  • memory/3832-179-0x0000000000000000-mapping.dmp
    Download