Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    08-05-2021 18:03

General

  • Target

    scan of check 288206.xlsm

  • Size

    86KB

  • MD5

    fef6a1ca7797ac6833de5bdb49f17c10

  • SHA1

    13a53cbc65e4fef639f3b31948b79e4913b9239b

  • SHA256

    7bf750678ab5834bba278727bce90e0b719820601f888926da5ab1335fe2857f

  • SHA512

    730eab1d3ee0e066372d35bf5c9617e09515fdaba0fc9dafdd2cfab02d9d7909b0cefe520bb0de047a9f90e05bacc3c984e9528ed6cd1a9d20d25e19be1e2e12

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\scan of check 288206.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3212

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3212-114-0x00007FF7E1D00000-0x00007FF7E52B6000-memory.dmp

    Filesize

    53.7MB

  • memory/3212-115-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

    Filesize

    64KB

  • memory/3212-116-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

    Filesize

    64KB

  • memory/3212-117-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

    Filesize

    64KB

  • memory/3212-118-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

    Filesize

    64KB

  • memory/3212-122-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

    Filesize

    64KB

  • memory/3212-121-0x00007FF859140000-0x00007FF85A22E000-memory.dmp

    Filesize

    16.9MB

  • memory/3212-123-0x000001CBB4100000-0x000001CBB5FF5000-memory.dmp

    Filesize

    31.0MB

  • memory/3212-179-0x000001CBC7AB0000-0x000001CBC7AB4000-memory.dmp

    Filesize

    16KB