Analysis
-
max time kernel
141s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
31-07-2022 04:42
General
-
Target
37d7af54754b3a9a5c0674ea23297c2af0e46b6ed502d22141c023aae5c188cb.xls
-
Size
678KB
-
MD5
53317e2ac82fd8048ce33b8b77b104d8
-
SHA1
af76f7a1db8dc29c670d91a01bd7d015618dbd5f
-
SHA256
37d7af54754b3a9a5c0674ea23297c2af0e46b6ed502d22141c023aae5c188cb
-
SHA512
0a24f3efde33981b87ee96f293288a8168e9a86198170ea3854d5d685c964fd648504b19d35028cfc07e0520530fcb594b5a4c7ca8c7a5372d3e9ace9af28d1f
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 32 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\37d7af54754b3a9a5c0674ea23297c2af0e46b6ed502d22141c023aae5c188cb.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD522228b7db5b4ef6b31f68ae139f7f3ae
SHA121d2f871fd396aa0ed6f8e947139a3cb0787dc1b
SHA2561746e560497a8adbd729ca4139082d78e0fc78020e10d1699ca63726ae2ebc22
SHA512f32f061b1cda1646860c0fa22c0a8a1b0ae839dc4971b449afb910ecf08e709ba5f1ee6cb3716d6842f56e8956f845203d74c3618a7c7cd13c2ab7e84efa5d65
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
12KB
-
Filesize
336KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB