Analysis

  • max time kernel
    124s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    31-01-2022 11:58

General

  • Target

    2022 Project Proposal.xlsx

  • Size

    187KB

  • MD5

    04ac21a7f53f1272fdbeda43806427e2

  • SHA1

    79b5696e2e262573d4523cc158f4b296fe524626

  • SHA256

    301c7c22b62e1a034bdfe23c52e2bddf35701ae8ec20f4f25d8729eeaf533d78

  • SHA512

    265e154b1fa3634c3ecb7b15cc0de2f7660b47cda35f87c207414f3074041f689eed96d4eab84d32bc5acc0ebc764184ef977627f440f451ac981c5d741a673f

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs
  • Drops file in Windows directory 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2022 Project Proposal.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1472
  • C:\Windows\System32\WaaSMedicAgent.exe
    C:\Windows\System32\WaaSMedicAgent.exe 6be2c13b67024541c6d49d0bcc03dccb 32MVc5QI0USemlPwHkQbUQ.0.1.0.0.0
    1⤵
    • Modifies data under HKEY_USERS
    PID:4188
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1284

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1284-149-0x000002217EE50000-0x000002217EE54000-memory.dmp
    Filesize

    16KB

  • memory/1472-130-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB

  • memory/1472-132-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB

  • memory/1472-131-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB

  • memory/1472-133-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB

  • memory/1472-134-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB

  • memory/1472-135-0x00007FFB08950000-0x00007FFB08960000-memory.dmp
    Filesize

    64KB

  • memory/1472-136-0x00007FFB08950000-0x00007FFB08960000-memory.dmp
    Filesize

    64KB

  • memory/1472-151-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB

  • memory/1472-152-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB

  • memory/1472-153-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB

  • memory/1472-154-0x00007FFB0AD10000-0x00007FFB0AD20000-memory.dmp
    Filesize

    64KB