Analysis

  • max time kernel
    117s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    12-01-2022 04:00

General

  • Target

    69-61270.xlsm

  • Size

    118KB

  • MD5

    0f2bd22e41ca408211f2fcfbf4d05645

  • SHA1

    e396920d9f3ddaa9c1c25325794dc1cc9d5d860f

  • SHA256

    e58cd1fc646d37b9fd8040d9f7f4110bb07cbdadb1f5dd4a55413acacd33807d

  • SHA512

    75de138b42573b73253ca721cc2727ffcf0e0ce4336866e8e952380b3749ec7064a65ae6984ecd0f3d00e8784f40a2e00fe00fd18b78a60b4b54e888aacdd3fb

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\69-61270.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1672

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1672-115-0x00007FF836310000-0x00007FF836320000-memory.dmp

    Filesize

    64KB

  • memory/1672-116-0x00007FF836310000-0x00007FF836320000-memory.dmp

    Filesize

    64KB

  • memory/1672-117-0x00007FF836310000-0x00007FF836320000-memory.dmp

    Filesize

    64KB

  • memory/1672-118-0x00007FF836310000-0x00007FF836320000-memory.dmp

    Filesize

    64KB

  • memory/1672-119-0x000002380C080000-0x000002380C082000-memory.dmp

    Filesize

    8KB

  • memory/1672-120-0x000002380C080000-0x000002380C082000-memory.dmp

    Filesize

    8KB

  • memory/1672-121-0x000002380C080000-0x000002380C082000-memory.dmp

    Filesize

    8KB

  • memory/1672-127-0x00007FF832AF0000-0x00007FF832B00000-memory.dmp

    Filesize

    64KB

  • memory/1672-128-0x00007FF836310000-0x00007FF836320000-memory.dmp

    Filesize

    64KB

  • memory/1672-129-0x00007FF832AF0000-0x00007FF832B00000-memory.dmp

    Filesize

    64KB