Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
22-11-2022 13:20
General
-
Target
Setup_Topfpflanzenbau.exe
-
Size
3.1MB
-
MD5
e9a062d4f24c2c003ef66bbf1cb4b748
-
SHA1
030bccea94af099c807b81adc8db7596562c321e
-
SHA256
44ddc246d89d715c0a28d404f2907cf3cd655265f02fd9e29bdcd9d6c438791b
-
SHA512
71a6dde852314e2fdae1799b6ed253e4f7a43b25c9c4af591013a23adf0bb4908f23f9227e0fd152d2c3217f132cd0d5786c4418ea8af5de9f51c8e9a7c47a8e
-
SSDEEP
98304:foA1JJs+NmfqbKLOEyJzgijYU/vuQ2H+a7:g2u+NBbbJzjYU/jM+6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
-
Suspicious Office macro 1 IoCs
Office document equipped with macros.
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_Topfpflanzenbau.exe"C:\Users\Admin\AppData\Local\Temp\Setup_Topfpflanzenbau.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IHTR0.tmp\Setup_Topfpflanzenbau.tmp"C:\Users\Admin\AppData\Local\Temp\is-IHTR0.tmp\Setup_Topfpflanzenbau.tmp" /SL5="$60124,3031278,67072,C:\Users\Admin\AppData\Local\Temp\Setup_Topfpflanzenbau.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde3⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
701KB
MD549f873e8f3e7625a819905c0aeaa159b
SHA17bbda62db5e7c881f1198a4a27812f1d95040610
SHA256fcf3ae70e68aebe43d11264071f9ec1ad0222cb99aea777abe33942a227b23f5
SHA512194672abebef9fa21edcf4df20110b8027ce01b50775db47d824ea81e28d90cf3bad672df80ea1001c35c189e65c309e9dbbdfc6ce87579fb1d3e810b7911988
-
Filesize
701KB
MD549f873e8f3e7625a819905c0aeaa159b
SHA17bbda62db5e7c881f1198a4a27812f1d95040610
SHA256fcf3ae70e68aebe43d11264071f9ec1ad0222cb99aea777abe33942a227b23f5
SHA512194672abebef9fa21edcf4df20110b8027ce01b50775db47d824ea81e28d90cf3bad672df80ea1001c35c189e65c309e9dbbdfc6ce87579fb1d3e810b7911988
-
Filesize
1.3MB
MD51fd54587dcd04357df5bf88fbd52b070
SHA1017fc4442131ef7a7e4d9bcb69e8f3f452869bb2
SHA25613d2d0e53d400994bd372aaa69e71b8a9d6772c84d35e5b80ea25b3076fb8fb3
SHA512ce971c3dbf34bb43fd75bc6710186eee43931ac3fbe021248d90544e1c46f874aac4cf00ae3cb290ee1184cc1b756e22c6d949926dd013f1bb60ebdc804f7c8d
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
701KB
MD549f873e8f3e7625a819905c0aeaa159b
SHA17bbda62db5e7c881f1198a4a27812f1d95040610
SHA256fcf3ae70e68aebe43d11264071f9ec1ad0222cb99aea777abe33942a227b23f5
SHA512194672abebef9fa21edcf4df20110b8027ce01b50775db47d824ea81e28d90cf3bad672df80ea1001c35c189e65c309e9dbbdfc6ce87579fb1d3e810b7911988
-
Filesize
715KB
MD51f3ba4fbe02edd56d8520cbf83bf6fc0
SHA1560dd91a1db4c53976b2c076374d359594d9179f
SHA2569e2207023b584450d3bbb53dc2c4e8b689ddd1ea585afd1513a2542cc1e3ac13
SHA512efc2675feb7077c2861f76f97a5a4b21f46945a14dc3177ddffb4574849f55e4aa7f06ac1c7c4f44dc8650440aac1c4b92250dd0afaef8ede6ceb8fa9a6c33d7
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
8KB
-
Filesize
8KB
-
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
44KB
-
-
Filesize
44KB