Analysis
- max time kernel
119s - max time network
118s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
14/12/2021, 07:37
General
- Target Order QW1502.xll
- Size 1.0MB
- Sample211214-jftesafch8
- SHA256 380f15a57aee6d2e6f48ed36dd077be29aa3a3eb05bfb15a1a82b26cfedf6160
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Order QW1502.xll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\Order QW1502.xll"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/952-56-0x0000000076491000-0x0000000076493000-memory.dmp
memory/952-57-0x00000000004D0000-0x00000000004DC000-memory.dmp
memory/952-60-0x0000000004662000-0x0000000004663000-memory.dmp
memory/952-59-0x0000000004661000-0x0000000004662000-memory.dmp
memory/952-61-0x0000000004663000-0x0000000004664000-memory.dmp
memory/952-62-0x00000000049E0000-0x0000000004B5E000-memory.dmp
memory/952-63-0x0000000001DD0000-0x0000000001E06000-memory.dmp
memory/952-64-0x0000000004664000-0x0000000004666000-memory.dmp
memory/952-65-0x0000000006FA0000-0x000000000723E000-memory.dmp
memory/952-66-0x000000000466A000-0x000000000467B000-memory.dmp
memory/976-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp