Analysis

  • max time kernel
    106s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    22-07-2021 08:34

General

  • Target

    Payment Advice_GLV913332922.xlsx

  • Size

    1.2MB

  • MD5

    e8e5934ac8c39cedfb38985307ee7b03

  • SHA1

    2e861bf7dfb04fa42b2b7b31d85122c72d035ce6

  • SHA256

    ece4d2f1e91d723320e3c6374fa33aca7d05dc03d9403d91ab8388867d43c46b

  • SHA512

    8361e968d07c483b88fe2751210b6dd9fcf1c056624f8e96c2463f2cb389edd881c35b8d76303893742790c831cb20582e5c3c31e89971934000a960ac084fa1

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Advice_GLV913332922.xlsx"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1056
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Launches Equation Editor
    PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1056-59-0x000000002F121000-0x000000002F124000-memory.dmp
    Filesize

    12KB

  • memory/1056-60-0x0000000070E41000-0x0000000070E43000-memory.dmp
    Filesize

    8KB

  • memory/1056-61-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1056-65-0x0000000005482000-0x0000000005484000-memory.dmp
    Filesize

    8KB

  • memory/1056-68-0x000000000548A000-0x000000000548C000-memory.dmp
    Filesize

    8KB

  • memory/1056-67-0x0000000005489000-0x000000000548A000-memory.dmp
    Filesize

    4KB

  • memory/1056-66-0x0000000005484000-0x0000000005486000-memory.dmp
    Filesize

    8KB

  • memory/1056-64-0x0000000005480000-0x0000000005482000-memory.dmp
    Filesize

    8KB

  • memory/1056-69-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1688-62-0x00000000752B1000-0x00000000752B3000-memory.dmp
    Filesize

    8KB

  • memory/1688-63-0x0000000009540000-0x0000000009541000-memory.dmp
    Filesize

    4KB