Analysis

  • max time kernel
    114s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    12-07-2021 12:21

General

  • Target

    87482.xlsx

  • Size

    1.1MB

  • MD5

    691c1f98e15a9adfad552d13a383900c

  • SHA1

    b8b48ea114731bbe1f93074c5e57a7dc877aab36

  • SHA256

    7fdb072b859acf022effc3f1033b96b2c7f90faaecac8352c3e39db31c53cdaf

  • SHA512

    3ca064d10d8884014c4e56ef542a93afb8a0f1904323a26ac1f006007e74a5ff2414ace9df1bd8025113e87a3872a53f6dd22a893b1787cb666d28b255891fe5

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\87482.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:804

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/804-114-0x00007FF7F0830000-0x00007FF7F3DE6000-memory.dmp

    Filesize

    53.7MB

  • memory/804-115-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB

  • memory/804-116-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB

  • memory/804-117-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB

  • memory/804-118-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB

  • memory/804-121-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB

  • memory/804-122-0x00007FFA8F230000-0x00007FFA9031E000-memory.dmp

    Filesize

    16.9MB

  • memory/804-123-0x00007FFA8D330000-0x00007FFA8F225000-memory.dmp

    Filesize

    31.0MB

  • memory/804-332-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB

  • memory/804-333-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB

  • memory/804-334-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB

  • memory/804-335-0x00007FFA6EBC0000-0x00007FFA6EBD0000-memory.dmp

    Filesize

    64KB