ta505 | 7af28b6af51c21236e8dae283be35d078a9b412b918a5595bfaa4722231e1af3

Analysis

max time kernel
102s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7af28b6af51c21236e8dae283be35d078a9b412b918a5595bfaa4722231e1af3.xls
Size

287KB
MD5

3f80214290751d891dddf50abe200ad8
SHA1

0de99d5d3bce055876174ba6fac4df24f1320375
SHA256

7af28b6af51c21236e8dae283be35d078a9b412b918a5595bfaa4722231e1af3
SHA512

81dae2eb33499d1360226e657c421745f7ed92ce99a16bcf9cd6fcd57389464429e4eaacc70132f09ed30ed3dc586cc903cd8896563688f15a9545143d221b2f

Score

10^/10

ta505

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4732	3472	WerFault.exe	80

TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
ta505

Loads dropped DLL 1 IoCs

pid	Process
3472	EXCEL.EXE

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4732	3472	WerFault.exe	80

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{B2C48B6C-DAFC-4B72-90B7-91C74CA21BAC}\get.png:Zone.Identifier	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3472	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3472	EXCEL.EXE
3472	EXCEL.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3472	EXCEL.EXE

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE
3472	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4196	3472	EXCEL.EXE	87
PID 3472 wrote to memory of 4196	3472	EXCEL.EXE	87

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7af28b6af51c21236e8dae283be35d078a9b412b918a5595bfaa4722231e1af3.xls"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3472 -s 4872
  2⤵
  - Process spawned unexpected child process
  - Program crash
  PID:4732

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 3472 -ip 3472
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\carpc2.dll

Filesize
63KB

MD5
605f50c0726368595ec8af87aa60d0d1

SHA1
d9fa09c154873053440f474f5c4a4a300fce014a

SHA256
b41def8d777a13dd709bfbb2b46f572ed69d08263e98a6868de5751b4b015bd4

SHA512
73a986b9a5b86e4cac356071feb050a7bd5a91278238757c25de700d0789173c2b9a5736a57c67860fee92055f1b7987582d02491bd6e60cf6e4a0a5bfc814bb

Download Submit
memory/3472-133-0x00007FF7FC0D0000-0x00007FF7FC0E0000-memory.dmp

Filesize
64KB

Download
memory/3472-132-0x00007FF7FC0D0000-0x00007FF7FC0E0000-memory.dmp

Filesize
64KB

Download
memory/3472-130-0x00007FF7FC0D0000-0x00007FF7FC0E0000-memory.dmp

Filesize
64KB

Download
memory/3472-134-0x00007FF7FC0D0000-0x00007FF7FC0E0000-memory.dmp

Filesize
64KB

Download
memory/3472-135-0x00007FF7F9E10000-0x00007FF7F9E20000-memory.dmp

Filesize
64KB

Download
memory/3472-136-0x00007FF7F9E10000-0x00007FF7F9E20000-memory.dmp

Filesize
64KB

Download
memory/3472-137-0x0000020CE80AD000-0x0000020CE80AF000-memory.dmp

Filesize
8KB

Download
memory/3472-131-0x00007FF7FC0D0000-0x00007FF7FC0E0000-memory.dmp

Filesize
64KB

Download
memory/3472-140-0x0000020CEB8E0000-0x0000020CEB8E3000-memory.dmp

Filesize
12KB

Download
memory/3472-141-0x0000000066DD0000-0x0000000066DED000-memory.dmp

Filesize
116KB

Download
memory/3472-142-0x0000020CE80AD000-0x0000020CE80AF000-memory.dmp

Filesize
8KB

Download