Overview

overview

10

Static

static

PO02810-2021.xlsx

windows7_x64

10

PO02810-2021.xlsx

windows10_x64

1

Analysis

  • max time kernel
    119s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    28-10-2021 12:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO02810-2021.xlsx

  • Size

    699KB

  • MD5

    8f5ce58030fae03a136b5c3ce7f66337

  • SHA1

    e85430b66d81b5fffe515d323306ff988d6a094e

  • SHA256

    fcaa730e3be861d103fd5b3b017075b708899ef7928bc9a51b4eaeea17f8b243

  • SHA512

    559aebba3143605ef692fb43cd3d8ede91af69ba15d6e5abf8dbbd1e630308e230f54bebda7b398b74c7db255619edd473e3db0f563225a60451ee232597ab82

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO02810-2021.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4324

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1804-115-0x00007FFB51920000-0x00007FFB51930000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1804-116-0x00007FFB51920000-0x00007FFB51930000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1804-117-0x00007FFB51920000-0x00007FFB51930000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1804-118-0x00007FFB51920000-0x00007FFB51930000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1804-119-0x000001E3E65A0000-0x000001E3E65A2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1804-120-0x000001E3E65A0000-0x000001E3E65A2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1804-121-0x000001E3E65A0000-0x000001E3E65A2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1804-127-0x00007FFB51920000-0x00007FFB51930000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4324-255-0x0000000000000000-mapping.dmp
      Download