Analysis
-
max time kernel
138s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18/01/2022, 19:12
General
-
Target
31b22b3bfa7d0ca56d5da96fa37279dcfa197f6ab4caf533a51cb8bdcd5d90ec.xlsm
-
Size
99KB
-
MD5
5a8fa49e1cd7e07b7ff5e3fcc0377a47
-
SHA1
ce476bdd4b8dc12cbbc20ecadfc3963b52ccc180
-
SHA256
31b22b3bfa7d0ca56d5da96fa37279dcfa197f6ab4caf533a51cb8bdcd5d90ec
-
SHA512
2cc8a654aa02445203e56107e407027b880123b0630724b8ec86162142b954fe25b1d04e0cd66c6d99663becf36513bac4da2ac3cf95b936d9b9198e77bdf415
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
http://avionxpress.com/lp/T9b1Bga4FdDfP5HI/
xlm40.dropper
http://news.tapchivietkieu.info/wordpress/CJzFM/
xlm40.dropper
http://monosun.net/wp-includes/JcDnYBSKpyfU/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\31b22b3bfa7d0ca56d5da96fa37279dcfa197f6ab4caf533a51cb8bdcd5d90ec.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB