Overview
overview
10Static
static
8Restore Me...03.exe
windows7_x64
10Restore Me...03.exe
windows10_x64
100601063634...9.xlsm
windows7_x64
100601063634...9.xlsm
windows10_x64
100b19705689...ff.exe
windows7_x64
100b19705689...ff.exe
windows10_x64
100f5f5f5134...5b.exe
windows7_x64
100f5f5f5134...5b.exe
windows10_x64
10188bcacd74...6f.exe
windows7_x64
10188bcacd74...6f.exe
windows10_x64
101c2e4fc620...78.jar
windows7_x64
31c2e4fc620...78.jar
windows10_x64
31e39513b16...f8.exe
windows7_x64
61e39513b16...f8.exe
windows10_x64
6TT COPY.exe
windows7_x64
10TT COPY.exe
windows10_x64
1029e897846d...951d9c
linux_amd64
29e897846d...951d9c
linux_mipsel
29e897846d...951d9c
linux_mips
31c031a7f6...21.exe
windows7_x64
1031c031a7f6...21.exe
windows10_x64
10476b568daf...92.exe
windows7_x64
10476b568daf...92.exe
windows10_x64
104975909b70...64.doc
windows7_x64
14975909b70...64.doc
windows10_x64
14c0c8cbb0e...fe.exe
windows7_x64
104c0c8cbb0e...fe.exe
windows10_x64
108017a07f03...b3.xls
windows7_x64
108017a07f03...b3.xls
windows10_x64
108f23d20d11...8d.exe
windows7_x64
108f23d20d11...8d.exe
windows10_x64
1090f026ae86...37.exe
windows7_x64
10Analysis
-
max time kernel
101s -
max time network
59s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
20-07-2021 14:18
Static task
static1
Behavioral task
behavioral1
Sample
Restore Messages003.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Restore Messages003.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
060106363494814da48982a85e4c66f5d52e84a537dbb4acbc55067301d88679.xlsm
Resource
win7v20210408
Behavioral task
behavioral4
Sample
060106363494814da48982a85e4c66f5d52e84a537dbb4acbc55067301d88679.xlsm
Resource
win10v20210410
Behavioral task
behavioral5
Sample
0b1970568987b6e2a949dde9d4e249d704cbfaf622c80741db02dd711838abff.exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
0b1970568987b6e2a949dde9d4e249d704cbfaf622c80741db02dd711838abff.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
0f5f5f5134295164f769b3a5555c86ab37b94284a7fc61cd1bbbdd496b80c25b.exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
0f5f5f5134295164f769b3a5555c86ab37b94284a7fc61cd1bbbdd496b80c25b.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
188bcacd74aabebec45f6a24175295ed574de65516021c9f0739dff3e9666a6f.exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
188bcacd74aabebec45f6a24175295ed574de65516021c9f0739dff3e9666a6f.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
1c2e4fc620772752079b05cdd904aa18a3482066e3b6f11f5a798f6a278b9f78.jar
Resource
win7v20210410
Behavioral task
behavioral12
Sample
1c2e4fc620772752079b05cdd904aa18a3482066e3b6f11f5a798f6a278b9f78.jar
Resource
win10v20210408
Behavioral task
behavioral13
Sample
1e39513b16501c1ff55a8a9d4c7b4b27ad067f3063002541b74b43e547ca8bf8.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
1e39513b16501c1ff55a8a9d4c7b4b27ad067f3063002541b74b43e547ca8bf8.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
TT COPY.exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
TT COPY.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
29e897846dad42a2a15e6059927ed91f98a8ef5cf6fa13b2b08ef48b6e951d9c
Resource
ubuntu-amd64
Behavioral task
behavioral18
Sample
29e897846dad42a2a15e6059927ed91f98a8ef5cf6fa13b2b08ef48b6e951d9c
Resource
debian9-mipsel
Behavioral task
behavioral19
Sample
29e897846dad42a2a15e6059927ed91f98a8ef5cf6fa13b2b08ef48b6e951d9c
Resource
debian9-mipsbe
Behavioral task
behavioral20
Sample
31c031a7f6fb39ba50153376ee653388d606a8bc1268954460de5d37f91e4621.exe
Resource
win7v20210408
Behavioral task
behavioral21
Sample
31c031a7f6fb39ba50153376ee653388d606a8bc1268954460de5d37f91e4621.exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
476b568daffd903ccc4cde8c7f8d643eaba306fcad74e2f90dff37504bb11292.exe
Resource
win7v20210408
Behavioral task
behavioral23
Sample
476b568daffd903ccc4cde8c7f8d643eaba306fcad74e2f90dff37504bb11292.exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
4975909b70555a443f8acbb22ef17f932eed445bf52148043ca4a1cc10e43264.doc
Resource
win7v20210408
Behavioral task
behavioral25
Sample
4975909b70555a443f8acbb22ef17f932eed445bf52148043ca4a1cc10e43264.doc
Resource
win10v20210410
Behavioral task
behavioral26
Sample
4c0c8cbb0e933f865862852967071eb6908bca3c610d2b14a77149d756db00fe.exe
Resource
win7v20210410
Behavioral task
behavioral27
Sample
4c0c8cbb0e933f865862852967071eb6908bca3c610d2b14a77149d756db00fe.exe
Resource
win10v20210408
Behavioral task
behavioral28
Sample
8017a07f03965d9490f9cdbba68ff3a3580441ca0e76b140f1e4bb939c4073b3.xls
Resource
win7v20210410
Behavioral task
behavioral29
Sample
8017a07f03965d9490f9cdbba68ff3a3580441ca0e76b140f1e4bb939c4073b3.xls
Resource
win10v20210408
Behavioral task
behavioral30
Sample
8f23d20d11602a29f56c47a6efad0cffbd43a32c7fb4f2df5ebf4c5bace60d8d.exe
Resource
win7v20210410
Behavioral task
behavioral31
Sample
8f23d20d11602a29f56c47a6efad0cffbd43a32c7fb4f2df5ebf4c5bace60d8d.exe
Resource
win10v20210410
Behavioral task
behavioral32
Sample
90f026ae8692c2199e2a5e8ea618c93ff00fd5d07ac974191ca5f060c1f7c737.exe
Resource
win7v20210408
General
-
Target
8017a07f03965d9490f9cdbba68ff3a3580441ca0e76b140f1e4bb939c4073b3.xls
-
Size
712KB
-
MD5
01db26749ca18d3d1cadcdb367ac18ca
-
SHA1
6eb78092e667f7375177e5da42bd302a4e00c670
-
SHA256
8017a07f03965d9490f9cdbba68ff3a3580441ca0e76b140f1e4bb939c4073b3
-
SHA512
f31aecdb134bd0f0177e4466aa3fe540b4518f3e95a6c8e4549d609bf99e13ea7ee051e030664d57a5d0b20ec848407e5dbd58c2a69130d015c8099f248439a4
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1744 1932 mshta.exe EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEmshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1932 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1932 wrote to memory of 1744 1932 EXCEL.EXE mshta.exe PID 1932 wrote to memory of 1744 1932 EXCEL.EXE mshta.exe PID 1932 wrote to memory of 1744 1932 EXCEL.EXE mshta.exe PID 1932 wrote to memory of 1744 1932 EXCEL.EXE mshta.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\8017a07f03965d9490f9cdbba68ff3a3580441ca0e76b140f1e4bb939c4073b3.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exemshta "C:\ProgramData\qDialogPrint.sct"2⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\qDialogPrint.sctMD5
452d54472649b3023138ab5fa473958a
SHA1e0f841e2ba26c252d4c8d6d9c56e0da3cdb25131
SHA2569467fcd384ca2d5a4726d2fb29e68678c57626fd77391c2e090f0fea3a2ff946
SHA5126c837738d02b3a99e11214f95aae504b33f658dd85aea4181faf155b52294324474ec52f277ad7614f6c0c911629ee9118d3bb395337816a07e9a1b158240867
-
memory/1744-62-0x0000000000000000-mapping.dmp
-
memory/1932-59-0x000000002F1C1000-0x000000002F1C4000-memory.dmpFilesize
12KB
-
memory/1932-60-0x0000000070DA1000-0x0000000070DA3000-memory.dmpFilesize
8KB
-
memory/1932-61-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1932-64-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB