Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-03-2021 17:10
General
-
Target
document-1451616459.xls
-
Size
138KB
-
MD5
08d201c4489b47be625a3a230640dc20
-
SHA1
3f5264afa4b50968224a4c5a9e3d8a27a7fbb77b
-
SHA256
01c0663e41e4673d1609d753a854b37d53c4c9d533dad979ed86dcb26b82a4b2
-
SHA512
f65b65e640b8b2aec289dc38c8c96b251ae552c40743638b381ad676a0e36928fd9501328d1bf457025d3234df3793b9ac1eee41db0e4346e2eddaab7a555706
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 20 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1451616459.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\zfbfg.ere,DllRegisterServer2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.2MB