Analysis

  • max time kernel
    170s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    21-05-2022 12:58

General

  • Target

    88ee09c8848b1775e3e470d64fbe64f877e9edfc172a21318acbe0f2f99ac9df.xls

  • Size

    40KB

  • MD5

    35cef72c5abdb47cc705de2459f6bf16

  • SHA1

    2639ec69b35fa5633b0555bc61e4feda7ae23994

  • SHA256

    88ee09c8848b1775e3e470d64fbe64f877e9edfc172a21318acbe0f2f99ac9df

  • SHA512

    27c0c534eb18e19a6598b737787a4ce1fa70732d5ca6720070232fc4567b606bce4c2069cd2f15ac341e28af7095b13eb930d099b796d33be4a2b2ccab3ce043

Score
10/10

Malware Config

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://jimlowry.com/9tag/Mv2ZYY61NBOf8/

xlm40.dropper

http://stainedglassexpress.com/classes/veV/

xlm40.dropper

https://n-process.jp/base/HPH/

xlm40.dropper

http://www.4-hzim.org.zw/language/anCpC49vTB4/

xlm40.dropper

http://salledemode.com/tgroup.ge/6USqthYYyIPw4V/

xlm40.dropper

http://poiterdesign.eu/huur/nc/

Signatures

  • Checks processor information in registry ⋅ 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry ⋅ 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\88ee09c8848b1775e3e470d64fbe64f877e9edfc172a21318acbe0f2f99ac9df.xls"
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    PID:4624

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • memory/4624-114-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp
                        • memory/4624-115-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp
                        • memory/4624-116-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp
                        • memory/4624-117-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp
                        • memory/4624-126-0x00007FFCDAC90000-0x00007FFCDACA0000-memory.dmp
                        • memory/4624-127-0x00007FFCDAC90000-0x00007FFCDACA0000-memory.dmp
                        • memory/4624-276-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp
                        • memory/4624-277-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp
                        • memory/4624-278-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp
                        • memory/4624-279-0x00007FFCDE100000-0x00007FFCDE110000-memory.dmp