Analysis

  • max time kernel
    18s
  • max time network
    16s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    04-05-2021 16:32

General

  • Target

    Outstanding-Debt-468293141-05042021.xlsm

  • Size

    114KB

  • MD5

    260b7e0c31a4ade2e510b7637f4433bb

  • SHA1

    f75535fa9fcd20f91a52efe59ce4c2905b4c3954

  • SHA256

    99282af74cb17fb39a8633f89d82a1fce76dbb290e2753905d67cc81c6e55204

  • SHA512

    026a4cf79056774c111e95d1a2ad355f67b416da1de563508aef40528d0b2c0b087d76cfb63d50385dff5737a79cca9660243b5443cef0fa98bc200fad6fdefd

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Outstanding-Debt-468293141-05042021.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:668

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/668-114-0x00007FF7369C0000-0x00007FF739F76000-memory.dmp

    Filesize

    53.7MB

  • memory/668-115-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

    Filesize

    64KB

  • memory/668-116-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

    Filesize

    64KB

  • memory/668-117-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

    Filesize

    64KB

  • memory/668-118-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

    Filesize

    64KB

  • memory/668-121-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

    Filesize

    64KB

  • memory/668-122-0x00007FFAE5300000-0x00007FFAE63EE000-memory.dmp

    Filesize

    16.9MB

  • memory/668-123-0x00007FFAE3400000-0x00007FFAE52F5000-memory.dmp

    Filesize

    31.0MB