Analysis
- max time kernel
170s - max time network
201s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
15/02/2022, 08:51
General
- Target ORDER CONFIRMATION.xlsx
- Size 187KB
- Sample220215-kr6d6adaa9
- SHA256 9fc1caace18b3a02fca3d4a7e03113ee3ff8a822aaf6b28ecd16ad80f520671b
Malware Config
Signatures
- Drops file in Windows directory 7 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ORDER CONFIRMATION.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3496-137-0x000001D96FC60000-0x000001D96FC70000-memory.dmp
memory/3496-139-0x000001D972270000-0x000001D972274000-memory.dmp
memory/3496-138-0x000001D96FCC0000-0x000001D96FCD0000-memory.dmp
memory/4124-142-0x000001B1B3C50000-0x000001B1B3C54000-memory.dmp
memory/4736-134-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-135-0x00007FFD1F90D000-0x00007FFD1F90E000-memory.dmp
memory/4736-136-0x00007FFD1F910000-0x00007FFD1F911000-memory.dmp
memory/4736-130-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-133-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-132-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-131-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-143-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-144-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-145-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-146-0x00007FFCDF8F0000-0x00007FFCDF900000-memory.dmp
memory/4736-147-0x00007FFD1F90D000-0x00007FFD1F90E000-memory.dmp