Analysis
-
max time kernel
211s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
24-07-2022 15:05
General
-
Target
f9704b16c55b131c8b80be4cdc46a5b9ee4ec3b07c9060da846c6f46f5669459.xls
-
Size
721KB
-
MD5
0e8199b87cea34af9d5a919c3152c989
-
SHA1
2b2db989545c2c2559d425d43fc5e4f0f606df17
-
SHA256
f9704b16c55b131c8b80be4cdc46a5b9ee4ec3b07c9060da846c6f46f5669459
-
SHA512
886559bf14f8d752775b504550944099b0b03a8be8f250cac37730463754c2268c4e53e26e2270b6aa0edee476028d9ef0728e77a8004ea9e11e40b81fa767c6
Malware Config
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 27 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f9704b16c55b131c8b80be4cdc46a5b9ee4ec3b07c9060da846c6f46f5669459.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5d8b651890cca9ce184353ad70d96a5a2
SHA11f114c94ded277305a010eeb5b122b332def38c6
SHA2562f37c08a1b7b625a696181ca2624469e0f712ffb9387a76b21304b98ce38a772
SHA512e5c2ec6f972be6102ea17f2a6cfd8d3febf5b51a7f9f8c99a653fa8344449d59f593a37c01e5c3fe5948035ba1df7c3d027d6067494fdbbeb01433cbada4283d
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB