Overview

overview

10

Static

static

8

361138996b...r.xlsm

windows7_x64

10

361138996b...r.xlsm

windows10_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    22-12-2021 15:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    361138996b8beb0a2b93fc76b01de114.xlsm.vir.xlsm

  • Size

    387KB

  • MD5

    361138996b8beb0a2b93fc76b01de114

  • SHA1

    93cde623489e7174d5d116c5fb0b35de691c78d8

  • SHA256

    5c0a79af89a9383292db76652a6cfee60bc0509dc30250528f3c40002fc0f691

  • SHA512

    3de36e66b73f20d601b0c074de22e6f3edaca6502c956f7cac412d2a6642bf9112195008c0ab551cf34c428a4604f134a9fd4ffdd52c609b786fe3a63cad5bd7

Score
10/10
ostapdownloader

Malware Config

Signatures

  • Ostap JavaScript Downloader 1 IoCs

    Ostap is a JavaScript downloader that's been active since 2016. It's used to deliver several families, inluding TrickBot

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ostap

    Ostap is a JS downloader, used to deliver other families.

    downloaderostap
  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\361138996b8beb0a2b93fc76b01de114.xlsm.vir.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\..\..\..\..\..\5034t.dert.jse"
      2⤵
      • Process spawned unexpected child process
      PID:920
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1984
      • C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
        "C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1048
        2⤵
        • Process spawned suspicious child process
        • Suspicious use of WriteProcessMemory
        PID:1876
        • C:\Windows\SysWOW64\dwwin.exe
          C:\Windows\system32\dwwin.exe -x -s 1048
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          PID:1980
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\5034t.dert.jse"
        2⤵
          PID:328

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\5034t.dert.jse
        MD5

        0c24dcde2cd565de32848ee253ae4f19

        SHA1

        45b446f5082df17b02fed29b940bff9dad433313

        SHA256

        b99df5c89301ff3c7e56a23f11e72b7255252ce03fcaa2899f854811de6668c4

        SHA512

        68d627a368913c7038175f7efa82994b86b602bf11aac94528dc65d9bb102dd53a347090cbb3afb63d42b237ee06565132cb6235c9be47d0118cb1f58ffa4760

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\259417915.cvr
        MD5

        40b96a68bd092af3304c319fa6d4cd20

        SHA1

        4f4af41804ac33369a0960b365293d62e8ada904

        SHA256

        791115a813f5678faa651e8a87d4a48016ba7aa153fb4838b46b3ece3e65ba40

        SHA512

        7af04135b7f37c1125a699d57d88ba6346a282bf7eb4d59631ecc3ddf42fd1123395b362cf8dc27466e5b34023d88f6a63f4907803e2077c1de791ee04540e90

        Download Submit

      • memory/328-64-0x0000000000000000-mapping.dmp

        Download

      • memory/920-61-0x000000006CB21000-0x000000006CB23000-memory.dmp

        Filesize

        8KB

        Download

      • memory/920-59-0x0000000000000000-mapping.dmp

        Download

      • memory/920-60-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1100-62-0x000007FEFC3A1000-0x000007FEFC3A3000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1672-55-0x000000002FC81000-0x000000002FC84000-memory.dmp

        Filesize

        12KB

        Download

      • memory/1672-58-0x0000000005D20000-0x0000000005D22000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1672-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1672-56-0x0000000071C01000-0x0000000071C03000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1876-67-0x0000000000000000-mapping.dmp

        Download

      • memory/1980-69-0x0000000000000000-mapping.dmp

        Download

      • memory/1980-72-0x0000000000300000-0x0000000000301000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1984-65-0x0000000000000000-mapping.dmp

        Download