Analysis
- max time kernel
110s - max time network
129s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
14/12/2021, 07:37
General
- Target Order QW1502.xll
- Size 1.0MB
- Sample211214-jftesafch8
- SHA256 380f15a57aee6d2e6f48ed36dd077be29aa3a3eb05bfb15a1a82b26cfedf6160
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Order QW1502.xll"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\Order QW1502.xll"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2724-117-0x0000000004770000-0x0000000004771000-memory.dmp
memory/2724-116-0x0000000004770000-0x0000000004771000-memory.dmp
memory/2724-118-0x00000000047A0000-0x00000000047AC000-memory.dmp
memory/2724-121-0x0000000006D22000-0x0000000006D23000-memory.dmp
memory/2724-120-0x0000000006D20000-0x0000000006D21000-memory.dmp
memory/2724-122-0x0000000006D23000-0x0000000006D24000-memory.dmp
memory/2724-123-0x0000000004770000-0x0000000004771000-memory.dmp
memory/2724-127-0x0000000006E20000-0x0000000006F9E000-memory.dmp
memory/2724-136-0x00000000081C0000-0x00000000081F6000-memory.dmp
memory/2724-139-0x0000000008700000-0x0000000008701000-memory.dmp
memory/2724-140-0x0000000008300000-0x0000000008301000-memory.dmp
memory/2724-141-0x00000000082B0000-0x00000000082B1000-memory.dmp
memory/2724-142-0x0000000009C00000-0x0000000009E9E000-memory.dmp
memory/2724-143-0x0000000006D24000-0x0000000006D26000-memory.dmp
memory/2724-144-0x0000000006D26000-0x0000000006D28000-memory.dmp
memory/2724-147-0x0000000004770000-0x0000000004771000-memory.dmp