Analysis
-
max time kernel
152s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
31-07-2022 08:58
General
-
Target
db92aa79b35ef1aeceb4982d900ffbc1ee756b5e403095e0f7b9cba93f258391.xls
-
Size
282KB
-
MD5
21f24bec513e1787ddfc009cc1a05bd6
-
SHA1
780a483194d2224130e9a5f4c132c4443e2b32d5
-
SHA256
db92aa79b35ef1aeceb4982d900ffbc1ee756b5e403095e0f7b9cba93f258391
-
SHA512
23ab58256954c8a36f17e65d0b6703c82406e597b0dc5ddbd0080300efa86ba651af5279cc90aaeebce44c3378d237a705e70979add82d7a65505732fe5dbb32
Malware Config
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 23 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\db92aa79b35ef1aeceb4982d900ffbc1ee756b5e403095e0f7b9cba93f258391.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD55467e81b6c5417af0dcc566605b13481
SHA1eeecc25656f290630dcfe30218cdb69bb0f316aa
SHA256257bee57c5cac49ce0b5f9b160a3aaafde703ecc036cf4cf32975fc08c7f445e
SHA512baf888cd4fcd929b973fedbb791d5e1e320fd4fff0aa15372fa94a0d898e9942ac80bf8965caa5dc8565077ee9928aa6fa3997d7ab114914a08bd863a8789c48
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
12KB
-
Filesize
120KB