Analysis
-
max time kernel
112s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
31-07-2022 08:58
General
-
Target
ca2903b4a6423eccf466a1ab5ba83efc81c0e1ac76741eb2c6432e8e6efff64c.xls
-
Size
729KB
-
MD5
5fd6c9ca842ef4fd97dc05d666b8d2a9
-
SHA1
89be226ee9c2d0997ed4147e9c0c22f9fe1e5d88
-
SHA256
ca2903b4a6423eccf466a1ab5ba83efc81c0e1ac76741eb2c6432e8e6efff64c
-
SHA512
1f656a4ad976fdb80c1f645529471f867d1f6a931b9d3d3a99ed2c8eb085abc9f5b345dcdcb0c1a0dfec9eadf8272d32e20a250bae6f36dd56bfdca4e27947f0
Malware Config
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 27 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ca2903b4a6423eccf466a1ab5ba83efc81c0e1ac76741eb2c6432e8e6efff64c.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182KB
MD52164531e455808332d700ea37f9c1ed6
SHA1611f4b7b0b22d9e5fdc4d20e486656d10e5ebce4
SHA256ceb8e847a86ac613a7a9453cd98cd3e5d6db29649268d7c231f8197020acc17a
SHA51205d9a98f166669134f21234b29776580cfb368f74c66d586f8f70877750d8f32814244473cf48ad0d72f76e8c3740ca5b35c4558fa29d1da35dc302266a236e9
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB