Overview

overview

10

Static

static

8

3d68985e9c...51.xls

windows7_x64

10

3d68985e9c...51.xls

windows10-2004_x64

10

Analysis

  • max time kernel
    73s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    01-07-2022 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d68985e9c33958b324d57f35169b871a1c58491697057d6ed4c474a57a41c51.xls

  • Size

    283KB

  • MD5

    d1500ecd912ea4816ce4ed184fb85b4d

  • SHA1

    315b127de2bde334324a30d608545b05bf35c7fb

  • SHA256

    3d68985e9c33958b324d57f35169b871a1c58491697057d6ed4c474a57a41c51

  • SHA512

    1e89e106ea8754d1c3f806823110526ad56341c0a383a4877e38f2af2ed0fab84f6c3d4a6947e0e38baff852cb7b5c82733b34f0da3d79a50f8e6a10f87efd77

Score
10/10
ta505

Malware Config

Signatures

  • TA505

    Cybercrime group active since 2015, responsible for families like Dridex and Locky.

    ta505
  • Loads dropped DLL 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\3d68985e9c33958b324d57f35169b871a1c58491697057d6ed4c474a57a41c51.xls
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1992

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\masterbox1.dll
    Filesize

    76KB

    MD5

    1ec05f7a63bbb88eb31b6ea23988cff6

    SHA1

    ee22a86d915fb95e361cca3f4106757050e21770

    SHA256

    4bf7ea981b3e13b9aaae77a3588c466dce8ca5e3c93297eccac8cb5144ef17c8

    SHA512

    be22a29584a9650b271537fa3c7fc2a4a3eeea76c1f564e56e5db3aa84e21260601f852fe7581bb0e056f696916192fa1c3f1b97532c47f7b808b87d9be5e58d

    Download Submit

  • memory/1992-54-0x000000002F911000-0x000000002F914000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1992-55-0x0000000071861000-0x0000000071863000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1992-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1992-57-0x000000007284D000-0x0000000072858000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1992-58-0x00000000768D1000-0x00000000768D3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1992-73-0x0000000006A80000-0x00000000076CA000-memory.dmp

    Filesize

    12.3MB

    Download

  • memory/1992-74-0x000000007284D000-0x0000000072858000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1992-75-0x0000000006A80000-0x00000000076CA000-memory.dmp

    Filesize

    12.3MB

    Download