Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 05:19

General

  • Target

    843021e4a2dcaa8887c2e0945157f947dbfd81372d601be47416294355635496.xlsm

  • Size

    388KB

  • MD5

    dcf3d45ddee53a91d55c45614124f0f1

  • SHA1

    ac8889a3cbf370edf067029df9eb12e16aab5a81

  • SHA256

    843021e4a2dcaa8887c2e0945157f947dbfd81372d601be47416294355635496

  • SHA512

    15e8e146253488949468c30a999af89b88f086482a2e7ea610ba32084eb1c28930bd8b2a8b05631c425c275873ee81acda1d86b1c33514f05190ba5bd9fd95c2

Score
10/10

Malware Config

Signatures

  • Ostap JavaScript Downloader 1 IoCs

    Ostap is a JavaScript downloader that's been active since 2016. It's used to deliver several families, inluding TrickBot

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ostap

    Ostap is a JS downloader, used to deliver other families.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\843021e4a2dcaa8887c2e0945157f947dbfd81372d601be47416294355635496.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\..\..\..\..\..\5034o.sedrtgyh.jse"
      2⤵
      • Process spawned unexpected child process
      PID:828
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\5034o.sedrtgyh.jse"
      2⤵
        PID:1228

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/828-97-0x000000006BD21000-0x000000006BD23000-memory.dmp

      Filesize

      8KB

    • memory/1572-55-0x000000002F531000-0x000000002F534000-memory.dmp

      Filesize

      12KB

    • memory/1572-56-0x0000000070DA1000-0x0000000070DA3000-memory.dmp

      Filesize

      8KB

    • memory/1572-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1572-58-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

      Filesize

      8KB

    • memory/1572-59-0x0000000005CD0000-0x0000000005CD2000-memory.dmp

      Filesize

      8KB

    • memory/2036-98-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

      Filesize

      8KB