Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    18-10-2021 20:03

General

  • Target

    a0512e7537eac6c6d9bc33483261c2403c9ac0d49f6a10748b2ad81d591ec892.xlsx

  • Size

    343KB

  • MD5

    5645c8ea1ca2e5012d172b9fe4b265ae

  • SHA1

    edcf8460d3ab64dd385ec3cea70d29c520ec8ac9

  • SHA256

    a0512e7537eac6c6d9bc33483261c2403c9ac0d49f6a10748b2ad81d591ec892

  • SHA512

    0f3ad6af4e3b2a74e639eb88e6d8c64c7f686c3ec8f7b202f76b08864f92670b8e77a9b31aca304197a8555e95f11af5e18a287e883fc6303cc9463e9f80f4ce

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a0512e7537eac6c6d9bc33483261c2403c9ac0d49f6a10748b2ad81d591ec892.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3704

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3704-115-0x00007FFBABDA0000-0x00007FFBABDB0000-memory.dmp
    Filesize

    64KB

  • memory/3704-116-0x00007FFBABDA0000-0x00007FFBABDB0000-memory.dmp
    Filesize

    64KB

  • memory/3704-117-0x00007FFBABDA0000-0x00007FFBABDB0000-memory.dmp
    Filesize

    64KB

  • memory/3704-118-0x00007FFBABDA0000-0x00007FFBABDB0000-memory.dmp
    Filesize

    64KB

  • memory/3704-119-0x000001735ED70000-0x000001735ED72000-memory.dmp
    Filesize

    8KB

  • memory/3704-120-0x000001735ED70000-0x000001735ED72000-memory.dmp
    Filesize

    8KB

  • memory/3704-121-0x00007FFBABDA0000-0x00007FFBABDB0000-memory.dmp
    Filesize

    64KB

  • memory/3704-122-0x000001735ED70000-0x000001735ED72000-memory.dmp
    Filesize

    8KB

  • memory/3704-128-0x00007FFBA8230000-0x00007FFBA8240000-memory.dmp
    Filesize

    64KB

  • memory/3704-129-0x00007FFBA8230000-0x00007FFBA8240000-memory.dmp
    Filesize

    64KB