Overview

overview

8

Static

static

_FM_BUSAN_..._.xlsx

windows7_x64

8

_FM_BUSAN_..._.xlsx

windows10-2004_x64

4

Analysis

  • max time kernel
    161s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    16-02-2022 08:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    _FM_BUSAN_HOCHIMINH_.xlsx

  • Size

    187KB

  • MD5

    9d7bf0f2fbb81660c8b91c2a323fde4e

  • SHA1

    7adf1d60fd08b3accd3a8e58fbdcc674bd1b02ee

  • SHA256

    d60188bc3e17e3fe9a8353a5eb4b791316968f3c1cea1e4e88138718efec0611

  • SHA512

    39842639f118d709102b7e8440cf569d542ca950f77dca21615b74639ac3e1f50bf9901e4def0df93d4addfe3f8dbc2a4e46e84cf56c85ec33c6f8d43e19f462

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\_FM_BUSAN_HOCHIMINH_.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:956
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4560
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/956-136-0x00007FFCA67D0000-0x00007FFCA67D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/956-130-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/956-132-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/956-133-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/956-134-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/956-135-0x00007FFCA67CD000-0x00007FFCA67CE000-memory.dmp
    Filesize

    4KB

    Download
  • memory/956-131-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/956-143-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/956-140-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/956-142-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/956-141-0x00007FFC667B0000-0x00007FFC667C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4560-137-0x00000171C9D60000-0x00000171C9D70000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4560-139-0x00000171CC9C0000-0x00000171CC9C4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/4560-138-0x00000171CA320000-0x00000171CA330000-memory.dmp
    Filesize

    64KB

    Download