Analysis

  • max time kernel
    138s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    29-10-2020 04:37

General

  • Target

    doc_pack-2038416961.xlsb

  • Size

    24KB

  • MD5

    c16b386a10fa33bde46bce04a7f3a0c4

  • SHA1

    f4061357776c691f6cb4759bd341023e9aa07140

  • SHA256

    68828f08dd325b2e9c970314bbd6ef09d32271882b2bebf4a4914ecea739b019

  • SHA512

    3526e3a2b32aa6f6c2733bc3a29cab15b43932c72ff256b1731c7793b22430f826a80f8419556c82989d7e6c1b3925896a1b6c1d2b4c0845fe812d1ae1e27310

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\doc_pack-2038416961.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1124

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1124-0-0x00007FFC81F30000-0x00007FFC82567000-memory.dmp

    Filesize

    6.2MB