Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 04:56
General
-
Target
e3c699b99e619fcac6e0364470028d79e8c96249b52ecaee2d2c832b03a594c4.xls
-
Size
785KB
-
MD5
6bc533050dcfd3790b0df8ec6bb5ed70
-
SHA1
14a5335469a3d93f8bf677cfb2f1c03cfa11c606
-
SHA256
e3c699b99e619fcac6e0364470028d79e8c96249b52ecaee2d2c832b03a594c4
-
SHA512
f23752706d16d6db398642f3fd07db2cfe0d9c6e639341a1286b76b1199a5ea8c3c5beb5abc87cdb44106e8ab740d797189141cb74d9537d182f4af16734ecae
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 27 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e3c699b99e619fcac6e0364470028d79e8c96249b52ecaee2d2c832b03a594c4.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
317KB
MD50daaf793cb4cae4900dd902a466f1395
SHA1aa25426489fe4374ca4ebdbe197bda8a17b47e8d
SHA2560454c0063273812d7f948cda4c9c7a9be1cca0a5a24cad7f74bda8136159b350
SHA5127c15709b7fdfac4b8934384c002b09f72f7ae38bb84fe9fb9978a604a83b2277021635314d3acb81fff20734e7b23599c000e3dc9a5fb1982b82ece7f2406573
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
652KB
-
Filesize
652KB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB