Overview

overview

8

Static

static

8

Order-13822.xls

windows7_x64

1

Order-13822.xls

windows10_x64

1

Resubmissions

17-12-2020 17:26

201217-wjvrnjhlg6 10

24-06-2020 14:54

200624-6mjajb17m2 8

Analysis

  • max time kernel
    142s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    24-06-2020 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Order-13822.xls

  • Size

    111KB

  • MD5

    ee70031efbe62f81aa3c434ae0636a09

  • SHA1

    a9ebd7146771b922cb9a21456566fce7e93919c0

  • SHA256

    147679b401d295a5300cde9e2ad39a1a2b5a09757c1a248dd53914bdb9678140

  • SHA512

    9f3dfee086cf585601002d449613c34295e5e5fdad29bd41750e96011c2073d8e923109ebdf490d52b3c658174f3b7e0f6f2f47f5a64e63a40ded6d30b84adc4

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order-13822.xls"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Checks processor information in registry
    PID:1820

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1820-0-0x000001191A000000-0x000001191A001000-memory.dmp

    Filesize

    4KB

    Download