Analysis
-
max time kernel
187s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 06:21
General
-
Target
4da2b862979ff7d73021e4f00db408b0cee63fdc3967a0c591b94f1d619ce87c.xls
-
Size
691KB
-
MD5
9cd9936a613386a126448c82bdb13ee4
-
SHA1
efc8cc57b49d120ebdfdf591e3cc40e3c94da91b
-
SHA256
4da2b862979ff7d73021e4f00db408b0cee63fdc3967a0c591b94f1d619ce87c
-
SHA512
5a33ae2d8e61f761b99a0ade4b4bfdb4cfc5833edbcb2e85755b47a62ccaa7d8b617b202abd8e1a6e1539af5480fa1c4ee0e503eb944de0bcdeb2a5ea69fb475
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 26 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4da2b862979ff7d73021e4f00db408b0cee63fdc3967a0c591b94f1d619ce87c.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD57981bcf1211b696fd0510ee807660772
SHA1a182536ac1476a19b8b2ac3b33ff2d96c887114a
SHA2569dff540081d64c60c0b8299a55aeace8dbe788ac839fa5381960373a0c3e8a95
SHA51219b5b8eace50c76dfd4edc98acb7e39b4aee4e5fe97046150be3ede4f696dc4c40f06a49b100c7c45edf7c1e5b0c3270245b1c0cf2ae63b997794c0d5b88b250
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB