Analysis

  • max time kernel
    141s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-11-2020 17:00

General

  • Target

    document-1772254866.xlsb

  • Size

    291KB

  • MD5

    6755b8b2d87a67cb73e18314adbc9d97

  • SHA1

    5908e16147367e062dce19201e694295ac63a469

  • SHA256

    0a134e35f3451ca0c13de87f6329b8d427d7eaeb6715ee2672a4afc69cf939fe

  • SHA512

    3e4b988dd2c2a3af4085426667fd294008dcdedb3b412b164f85d54d3dc92a63d6f25ba7ce7ad02dff1983555318220c0ce5846c81a5eff32fbf84d65b948cf9

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1772254866.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:640

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/640-0-0x00007FFA00680000-0x00007FFA00CB7000-memory.dmp
    Filesize

    6.2MB