Overview

overview

10

Static

static

8

Invoice-64...3.xlsb

windows7_x64

10

Invoice-64...3.xlsb

windows10_x64

10

Analysis

  • max time kernel
    126s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    14-10-2021 14:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice-64145512_20211013.xlsb

  • Size

    269KB

  • MD5

    4e6d8b34d4441d66984a1b4fa51fe561

  • SHA1

    a991079981a98f9cf3ceba151ce56d39fa522b5d

  • SHA256

    6a5cd724baaebc19773830980de192cfa10e9d921469153399e656fbdd0ff972

  • SHA512

    a934d862c117c7010b17473fe6c9d71824f43a95fe48e7bf93ce5505142a8dd29b5aacc9dc75bf7257571e494ae6b39e6ec399f9efa0e9dbb99722bcaa080804

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice-64145512_20211013.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Windows\System32\Wbem\wmic.exe
      wmic process call create 'mshta C:\ProgramData\srwREKktqM.rtf'
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of AdjustPrivilegeToken
      PID:1664
  • C:\Windows\system32\mshta.exe
    mshta C:\ProgramData\srwREKktqM.rtf
    1⤵
    • Process spawned unexpected child process
    PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\srwREKktqM.rtf
    MD5

    8d1f493b8af4febc05b5dd0634f1d24c

    SHA1

    65e9bf9e203aab1b72c7878660044f42bf15c7f3

    SHA256

    89b7347a7ce8567b3178767c556f799507aed73a96b06619d3e541c7107c3d23

    SHA512

    b3af047052fa1c577295683d051bb6fa93c18b723941a48e3bd1daff39f033fe3e0bb4a470599c74fe52bf7c14cf096796f9c2bc79451ce4c521236e63061917

    Download Submit
  • memory/1664-267-0x0000000000000000-mapping.dmp
    Download
  • memory/2468-115-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2468-116-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2468-117-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2468-118-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2468-119-0x00007FFCB3220000-0x00007FFCB3230000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2468-121-0x000001E2258B0000-0x000001E2258B2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2468-120-0x000001E2258B0000-0x000001E2258B2000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2468-122-0x000001E2258B0000-0x000001E2258B2000-memory.dmp
    Filesize

    8KB

    Download