Analysis

  • max time kernel
    150s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    21-07-2021 20:46

General

  • Target

    c77cd6616dedbf3669345842f7231830.xls

  • Size

    661KB

  • MD5

    c77cd6616dedbf3669345842f7231830

  • SHA1

    2a1bd1b6e7048c8e051fcc95707a6f2e6bc61b88

  • SHA256

    f4643ab52e51d05bce715ec6d0baae09ef15763318928c1ed8d3c24b72df3602

  • SHA512

    b036233b58e2fa6c5c2732e692340fc89e04614606903cd4aaa5ddd80950d35dc1d570c46a1fb48b4618e05dd3629da5662652743915ed33d60f2d7ae29c0ed5

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\c77cd6616dedbf3669345842f7231830.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\ProgramData//klDYMFormat.sct
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Modifies Internet Explorer settings
      PID:2028

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\klDYMFormat.sct

    MD5

    bdaa2a11f77d89d3f5e81f9d17fb3b87

    SHA1

    0ae03773f2dfde92f8a58d03226462d178a8c85e

    SHA256

    5f0a0616ea02e338125ad190bdfa6e8fb6f2a8f4f5845252a8b5422bd283cd88

    SHA512

    b06f4d5627fa0d27c9e1aaa45597d92edec4e103413dc92719c4162e8de3a06022e471dbd283a6b1e9da466b10315b67c8faf74215d2213d8ae2fa0ae42a53ed

  • memory/1676-59-0x000000002F751000-0x000000002F754000-memory.dmp

    Filesize

    12KB

  • memory/1676-60-0x00000000716F1000-0x00000000716F3000-memory.dmp

    Filesize

    8KB

  • memory/1676-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1676-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2028-62-0x0000000000000000-mapping.dmp