Overview

overview

10

Static

static

8

SecuriteIn...9.xlsm

windows7_x64

10

SecuriteIn...9.xlsm

windows10_x64

10

Analysis

  • max time kernel
    110s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-04-2021 00:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Heur.10624.9849.xlsm

  • Size

    144KB

  • MD5

    060d95988fc565133a252aadc91ea24f

  • SHA1

    59a2f22c0c6622b2074f2fa59a1136b430aaffb3

  • SHA256

    b6430f1c70dd393e02aadb47cb51716844f13bc53dc5258887d6c257a01c5563

  • SHA512

    d178fac514d78d334271fe28ba0c92be8cbfbb4240ce1e725effb0458e28f259e3a2b6983e46f7a17e4fd1a862e9a99e8f1061983057e10dd2dc6f479782155f

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.10624.9849.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\27894..dll" JsVarAddRef
      2⤵
      • Process spawned unexpected child process
      PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\27894..dll
    MD5

    19157d8ea39861b26d6dabf104719a30

    SHA1

    638552c3b13a1f405c80e160d0c218227c060391

    SHA256

    9193aee125957c65bba2b6fe0ee443d2152b1eb87686b47f438a92818ee5ba18

    SHA512

    0c7ccbba24ec909a15b5aeb8f358b60b2ed704d2680068bb24dc9a8998de2f8091602e0b995051dc97635603a13c42c4b6a372ecb73aa48d9b99275a4a84773a

    Download Submit
  • memory/640-114-0x00007FF6F8100000-0x00007FF6FB6B6000-memory.dmp
    Filesize

    53.7MB

    Download
  • memory/640-115-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/640-116-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/640-117-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/640-118-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/640-122-0x00007FFD9F860000-0x00007FFD9F870000-memory.dmp
    Filesize

    64KB

    Download
  • memory/640-121-0x00007FFDBFCB0000-0x00007FFDC0D9E000-memory.dmp
    Filesize

    16.9MB

    Download
  • memory/640-123-0x00000179C3CF0000-0x00000179C5BE5000-memory.dmp
    Filesize

    31.0MB

    Download
  • memory/844-179-0x0000000000000000-mapping.dmp
    Download