Overview

overview

10

Static

static

8

38d3f51738...4.xlsm

windows7_x64

10

38d3f51738...4.xlsm

windows10-2004_x64

8

Analysis

  • max time kernel
    151s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 07:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    38d3f5173827b3d7f213cb95de47e2087937eef5c9c3d48caf1dfb9098a063d4.xlsm

  • Size

    388KB

  • MD5

    83a7ee52acc9f9f728d268acce20d30c

  • SHA1

    35ba05bc81abc4e0471efd47dcb69dc262623409

  • SHA256

    38d3f5173827b3d7f213cb95de47e2087937eef5c9c3d48caf1dfb9098a063d4

  • SHA512

    eb6f3dd0b7ab4ce4e643c0b809de2c6e697ba8d3e2683590c7dccd56223fcc51d4d53faba55d121de8b969ff6f9bf0b5f36cea4163c64155bc9e20c8a27042bb

Score
10/10
ostapdownloader

Malware Config

Signatures

  • Ostap JavaScript Downloader 1 IoCs

    Ostap is a JavaScript downloader that's been active since 2016. It's used to deliver several families, inluding TrickBot

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ostap

    Ostap is a JS downloader, used to deliver other families.

    downloaderostap
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\38d3f5173827b3d7f213cb95de47e2087937eef5c9c3d48caf1dfb9098a063d4.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\..\..\..\..\..\5034o.sedrtgyh.jse"
      2⤵
      • Process spawned unexpected child process
      PID:1560
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\5034o.sedrtgyh.jse"
      2⤵
        PID:772

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\5034o.sedrtgyh.jse
      MD5

      944cf5c272b0d6a5261f104f97753a78

      SHA1

      09e99bce2295aec3263ada0440655e6faaa205d4

      SHA256

      490a79b9ecee092c3cf27c106c97a7f7150f4646c42a3703f533296724815659

      SHA512

      2d515b98b0669d89b2e4f39d1d11ba5c247a9a7b4c473d133317fb1c3d43d277ec07ccfce99c88ad1c7cb1fe5da8055a1de5d3fe54db0240d0835a3a42aec93a

      Download Submit

    • memory/1332-62-0x000007FEFC401000-0x000007FEFC403000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1560-61-0x000000006C9E1000-0x000000006C9E3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1620-55-0x000000002F7E1000-0x000000002F7E4000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1620-56-0x0000000071B01000-0x0000000071B03000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1620-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1620-58-0x0000000076641000-0x0000000076643000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1620-59-0x0000000005B10000-0x0000000005B12000-memory.dmp

      Filesize

      8KB

      Download