Analysis

  • max time kernel
    86s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    09-08-2022 10:12

General

  • Target

    sample20220809-01.xls

  • Size

    84KB

  • MD5

    5bc2a4eefe16c8465f076bdfc3d38870

  • SHA1

    71d800ce5f7cbd5f9d3ba9a16626c592bbc28c46

  • SHA256

    89d6b9a0f7d4f30f5021a893925dfbea12051a0d3e5f5845fd1bc45b74eed830

  • SHA512

    84b5ead8d2a3be2f86d3b568a1eaf22c425910d5bb7df75e31264aa4c79eb4b8e86f9728b8b7f6400026e782a6114a0626a8bb0f806e44ac688039077b6970c0

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\sample20220809-01.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1204
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\Documents\.
    1⤵
    • Process spawned unexpected child process
    PID:1076

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1204-54-0x000000002FBF1000-0x000000002FBF4000-memory.dmp
    Filesize

    12KB

  • memory/1204-55-0x00000000712B1000-0x00000000712B3000-memory.dmp
    Filesize

    8KB

  • memory/1204-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1204-57-0x000000007229D000-0x00000000722A8000-memory.dmp
    Filesize

    44KB

  • memory/1204-58-0x00000000754C1000-0x00000000754C3000-memory.dmp
    Filesize

    8KB

  • memory/1204-60-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-59-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-61-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-62-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-63-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-64-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-65-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-66-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-68-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-67-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-69-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-70-0x000000007229D000-0x00000000722A8000-memory.dmp
    Filesize

    44KB

  • memory/1204-72-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-71-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-73-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-74-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-75-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-76-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-77-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-79-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-78-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-81-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-80-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-83-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-84-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-85-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-82-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-87-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-86-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-88-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-89-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-90-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-91-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-92-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-94-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-95-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-96-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-97-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-93-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-99-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-100-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-98-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-102-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-103-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-101-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-105-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-104-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-107-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-108-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-109-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-106-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-111-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-112-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-113-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-110-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-114-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-115-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-116-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-117-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-118-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB

  • memory/1204-119-0x0000000000801000-0x0000000000805000-memory.dmp
    Filesize

    16KB