Analysis

  • max time kernel
    4265063s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    17-01-2022 14:03

General

  • Target

    tmp/55294d13ba1d75f9daa7e87c0025c3efc6092ea3de41d3807ab5f50b87df9e89.xls

  • Size

    299KB

  • MD5

    5c899ea523fc5a003a2ee3de8f11bd02

  • SHA1

    ef20b0be5970fc46faa0ff9bdfcd6e00f134653f

  • SHA256

    55294d13ba1d75f9daa7e87c0025c3efc6092ea3de41d3807ab5f50b87df9e89

  • SHA512

    6ad715cb75f4bde32e4eebea96ca2f6091b68eaa6a370a0f4739edb883d72e920fe01e5b8cd110456f23d007f1b5037d0e70d62f15bbe2f40ee0e930264714db

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\tmp\55294d13ba1d75f9daa7e87c0025c3efc6092ea3de41d3807ab5f50b87df9e89.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:212
  • C:\Windows\system32\MusNotification.exe
    C:\Windows\system32\MusNotification.exe
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/212-130-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB

  • memory/212-131-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB

  • memory/212-132-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB

  • memory/212-133-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB

  • memory/212-134-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB

  • memory/212-135-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-136-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-137-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-138-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-139-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-140-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-141-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-142-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-143-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-144-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-145-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-146-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-147-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-148-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-150-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-149-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-152-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-151-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-153-0x0000022E03880000-0x0000022E03882000-memory.dmp
    Filesize

    8KB

  • memory/212-154-0x0000022E03880000-0x0000022E03884000-memory.dmp
    Filesize

    16KB

  • memory/212-155-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-156-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-157-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-159-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-160-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-158-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-161-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-162-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-163-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-164-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-165-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-166-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-167-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-168-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-169-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-170-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-171-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-172-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-173-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-174-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-175-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-176-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-177-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-178-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-179-0x0000022E03880000-0x0000022E03886000-memory.dmp
    Filesize

    24KB

  • memory/212-180-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB

  • memory/212-182-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB

  • memory/212-181-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB

  • memory/212-183-0x00007FFE6E590000-0x00007FFE6E5A0000-memory.dmp
    Filesize

    64KB