Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 12:56
Static task
static1
Behavioral task
behavioral1
Sample
catalog-2082234753.xls
Resource
win7v20210408
Behavioral task
behavioral2
Sample
catalog-2082234753.xls
Resource
win10v20210410
General
-
Target
catalog-2082234753.xls
-
Size
367KB
-
MD5
377979b8ec401411aff27b271837a30c
-
SHA1
19da1a5260761083698055a6151dc9af8463c25f
-
SHA256
9f19557269565477a97fb8095c3449c3e9b61bf75a8ea5f67a445dab68854392
-
SHA512
7f890705b6cdad0e9ef5dfe3df06d4ca78de2f48c35efa7607926c93dc60bf8563b4a94e1836276bc76ad77bffee85a7eddd26579c9404510d056b1855dbfa0c
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 184 3952 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3148 3952 rundll32.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3952 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 3952 EXCEL.EXE 3952 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE 3952 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 3952 wrote to memory of 184 3952 EXCEL.EXE rundll32.exe PID 3952 wrote to memory of 184 3952 EXCEL.EXE rundll32.exe PID 3952 wrote to memory of 3148 3952 EXCEL.EXE rundll32.exe PID 3952 wrote to memory of 3148 3952 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\catalog-2082234753.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\tuti.rut,DllRegisterServer2⤵
- Process spawned unexpected child process
PID:184 -
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\tuti.rut1,DllRegisterServer2⤵
- Process spawned unexpected child process
PID:3148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/184-179-0x0000000000000000-mapping.dmp
-
memory/3148-180-0x0000000000000000-mapping.dmp
-
memory/3952-114-0x00007FF77DB50000-0x00007FF781106000-memory.dmpFilesize
53.7MB
-
memory/3952-115-0x00007FFA08250000-0x00007FFA08260000-memory.dmpFilesize
64KB
-
memory/3952-116-0x00007FFA08250000-0x00007FFA08260000-memory.dmpFilesize
64KB
-
memory/3952-117-0x00007FFA08250000-0x00007FFA08260000-memory.dmpFilesize
64KB
-
memory/3952-118-0x00007FFA08250000-0x00007FFA08260000-memory.dmpFilesize
64KB
-
memory/3952-122-0x00007FFA08250000-0x00007FFA08260000-memory.dmpFilesize
64KB
-
memory/3952-121-0x00007FFA28EB0000-0x00007FFA29F9E000-memory.dmpFilesize
16.9MB
-
memory/3952-123-0x00007FFA26EF0000-0x00007FFA28DE5000-memory.dmpFilesize
31.0MB