Analysis
-
max time kernel
145s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 12:53
General
-
Target
catalog-1940915897.xls
-
Size
367KB
-
MD5
f89d243fb68446e093dcacf45b516a43
-
SHA1
7f594ff6fd6ca244280e447c0c4ae0fe59b0a84d
-
SHA256
f418f4343a2409cbe8109206047737666ad6593871f9d87816ffeae6c3e58309
-
SHA512
973922cf1e09e0948a4e2322c61cd8ee1cfb8d9874ca9852166d5fd6eb956024aa8e10eb29f0a810970e82b9761f8eacb667c2e390f23074785541602a10770a
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\catalog-1940915897.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\tuti.rut,DllRegisterServer2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\tuti.rut1,DllRegisterServer2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
-
Filesize
53.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16.9MB
-
Filesize
31.0MB