Analysis

  • max time kernel
    118s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    10-11-2021 03:12

General

  • Target

    CI&BL shipping documents.xlsx

  • Size

    311KB

  • MD5

    bc374aadfcfd5dfafaa96a8461f109bf

  • SHA1

    bdfb5c095a97035e29ac95a1f7cbf5f561224af8

  • SHA256

    678d94aaf0de5200cbb7ec2d1829c4264019325a8d4f7000fc330d56844615a4

  • SHA512

    7c396ac68292b98cac3195b410b7774a45fafc40e08a6f05351b2aa2b8da379d0c70829a46186d62d7388eb64c5861765db91d450daab3e2825863c93c5d9366

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CI&BL shipping documents.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3868

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3868-115-0x00007FFBFB9F0000-0x00007FFBFBA00000-memory.dmp
    Filesize

    64KB

  • memory/3868-116-0x00007FFBFB9F0000-0x00007FFBFBA00000-memory.dmp
    Filesize

    64KB

  • memory/3868-117-0x00007FFBFB9F0000-0x00007FFBFBA00000-memory.dmp
    Filesize

    64KB

  • memory/3868-118-0x00007FFBFB9F0000-0x00007FFBFBA00000-memory.dmp
    Filesize

    64KB

  • memory/3868-119-0x00007FFBFB9F0000-0x00007FFBFBA00000-memory.dmp
    Filesize

    64KB

  • memory/3868-121-0x0000024419CB0000-0x0000024419CB2000-memory.dmp
    Filesize

    8KB

  • memory/3868-120-0x0000024419CB0000-0x0000024419CB2000-memory.dmp
    Filesize

    8KB

  • memory/3868-122-0x0000024419CB0000-0x0000024419CB2000-memory.dmp
    Filesize

    8KB