61958efc02d98446e4c3f05d2843a49cba4bb1519f03c1384c813a6acb803fdd

General

Target

20200817_-0000199191910.xls.exe
Size

862KB
MD5

82db0414466f600825a076a9bfc460f2
SHA1

e6ba314882ff122bd26e5f5ad0407c2b5e702981
SHA256

eb98cd837c0994df93bde2019caef785c7b7c9bfc373ca2135d928bd507bf3b3
SHA512

cf48e3a1935664818447c01c67911e962766902d3d561c7730d050bb964714fa91b92996391b210d30d3e45685e660f76632b11be876b11466cddd28e3953f2e

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 2564	3288	20200817_-0000199191910.xls.exe	85

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3288	20200817_-0000199191910.xls.exe
3288	20200817_-0000199191910.xls.exe
3288	20200817_-0000199191910.xls.exe
3288	20200817_-0000199191910.xls.exe
2564	20200817_-0000199191910.xls.exe
2564	20200817_-0000199191910.xls.exe
4480	powershell.exe
4480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3288	20200817_-0000199191910.xls.exe
Token: SeDebugPrivilege	2564	20200817_-0000199191910.xls.exe
Token: SeDebugPrivilege	4480	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2564	3288	20200817_-0000199191910.xls.exe	85
PID 3288 wrote to memory of 2564	3288	20200817_-0000199191910.xls.exe	85
PID 3288 wrote to memory of 2564	3288	20200817_-0000199191910.xls.exe	85
PID 3288 wrote to memory of 2564	3288	20200817_-0000199191910.xls.exe	85
PID 3288 wrote to memory of 2564	3288	20200817_-0000199191910.xls.exe	85
PID 3288 wrote to memory of 2564	3288	20200817_-0000199191910.xls.exe	85
PID 3288 wrote to memory of 2564	3288	20200817_-0000199191910.xls.exe	85
PID 3288 wrote to memory of 2564	3288	20200817_-0000199191910.xls.exe	85
PID 2564 wrote to memory of 1904	2564	20200817_-0000199191910.xls.exe	86
PID 2564 wrote to memory of 1904	2564	20200817_-0000199191910.xls.exe	86
PID 2564 wrote to memory of 1904	2564	20200817_-0000199191910.xls.exe	86
PID 1904 wrote to memory of 4480	1904	cmd.exe	88
PID 1904 wrote to memory of 4480	1904	cmd.exe	88
PID 1904 wrote to memory of 4480	1904	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\20200817_-0000199191910.xls.exe
"C:\Users\Admin\AppData\Local\Temp\20200817_-0000199191910.xls.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\20200817_-0000199191910.xls.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\20200817_-0000199191910.xls.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\20200817_-0000199191910.xls.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\20200817_-0000199191910.xls.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/2564-136-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2564-137-0x00000000056A0000-0x0000000005706000-memory.dmp

Filesize
408KB

Download
memory/3288-130-0x00000000006F0000-0x00000000007CE000-memory.dmp

Filesize
888KB

Download
memory/3288-131-0x0000000007B20000-0x00000000080C4000-memory.dmp

Filesize
5.6MB

Download
memory/3288-132-0x0000000007650000-0x00000000076E2000-memory.dmp

Filesize
584KB

Download
memory/3288-133-0x00000000076F0000-0x00000000076FA000-memory.dmp

Filesize
40KB

Download
memory/3288-134-0x00000000079E0000-0x0000000007A7C000-memory.dmp

Filesize
624KB

Download
memory/4480-141-0x0000000004C20000-0x0000000004C56000-memory.dmp

Filesize
216KB

Download
memory/4480-142-0x00000000052C0000-0x00000000058E8000-memory.dmp

Filesize
6.2MB

Download
memory/4480-143-0x00000000051B0000-0x00000000051D2000-memory.dmp

Filesize
136KB

Download
memory/4480-144-0x00000000051E0000-0x0000000005246000-memory.dmp

Filesize
408KB

Download
memory/4480-145-0x00000000060B0000-0x00000000060CE000-memory.dmp

Filesize
120KB

Download
memory/4480-146-0x00000000078E0000-0x0000000007F5A000-memory.dmp

Filesize
6.5MB

Download
memory/4480-147-0x00000000067D0000-0x00000000067EA000-memory.dmp

Filesize
104KB

Download
memory/4480-148-0x0000000007310000-0x00000000073A6000-memory.dmp

Filesize
600KB

Download
memory/4480-149-0x00000000072A0000-0x00000000072C2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing