Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 12:55
General
-
Target
catalog-2020881978.xls
-
Size
367KB
-
MD5
5a2568db8e7c6a6ca1d5fa3fa0551fbd
-
SHA1
407b216f063b697c7e7a11a0bdff3aee0db9a4c2
-
SHA256
959bf91990f85486ed20a9107aa06a661d11e4acebfebca1aa1e50f96f3b446b
-
SHA512
57479d7287bf0252c24287c6c4526439618a4aaefcf57f380c3f5826f3c1bb224d8fed6ab07153e0bea8e68f4a6207a7dbd4e2be9b56551cb4e7466aa21cf3db
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\catalog-2020881978.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\tuti.rut,DllRegisterServer2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\tuti.rut1,DllRegisterServer2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16.9MB
-
Filesize
31.0MB
-
-