Analysis
-
max time kernel
137s -
max time network
137s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
15/07/2020, 16:08
General
-
Target
fea072ba3f7917af9c87c1a68ea7ee4c0ca39d6df8c5c71843771d198c045e50.xls
-
Size
367KB
-
MD5
56a0b81c19d2d17c042e2b2c22744633
-
SHA1
cfb744ac8fdb24cf317d2e33802e878feddfd3e7
-
SHA256
fea072ba3f7917af9c87c1a68ea7ee4c0ca39d6df8c5c71843771d198c045e50
-
SHA512
9d195463a70cac76cdf30d667e1a891ede0a9f25edc1466f3ed955fdd85f65be283eb0d9dfbb872c9d37f00397c9e04ccb1843c478fd56fb09a29525ed37df0f
Score
10/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fea072ba3f7917af9c87c1a68ea7ee4c0ca39d6df8c5c71843771d198c045e50.xls"1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\cLKxjLh\tIpHswX\ONCWNER.dll,DllRegisterServer2⤵
- Process spawned unexpected child process
-