Analysis

  • max time kernel
    148s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    10-05-2021 06:31

General

  • Target

    Shipment Information.xls

  • Size

    410KB

  • MD5

    6a7bd45c84373b00086d7c0ecab1ffcd

  • SHA1

    ad3328cafb1fd86491f76705f2b5c9cb80394bc9

  • SHA256

    aa0c23ff57c890910a1ba814b727ab5512b55ff7785d975ed634bc6824d4502e

  • SHA512

    2b8af84d206568d35e1571977fb4237b1572bd0f4cd0f6a064d5f5a03643bfe124529b38c30f6dc3fc37dd3d66a3b14ffa118b91a377114bf03eb94243443730

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Shipment Information.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1056

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1056-60-0x000000002F261000-0x000000002F264000-memory.dmp

    Filesize

    12KB

  • memory/1056-61-0x0000000071701000-0x0000000071703000-memory.dmp

    Filesize

    8KB

  • memory/1056-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB