Analysis
- max time kernel
134s - max time network
142s - platform
windows10_x64 - resource
win10v20210408 - submitted
14/10/2021, 05:36
General
- Target destinations.xlsx
- Size 339KB
- Sample211014-gakvcagcd9
- SHA256 c45eacade4845c8cf141724b92d6fd4401d30233b18b17e295d2d7a9a8944c40
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\destinations.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-114-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp
memory/628-115-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp
memory/628-116-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp
memory/628-117-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp
memory/628-118-0x0000025AA68C0000-0x0000025AA68C2000-memory.dmp
memory/628-119-0x0000025AA68C0000-0x0000025AA68C2000-memory.dmp
memory/628-120-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp
memory/628-121-0x0000025AA68C0000-0x0000025AA68C2000-memory.dmp