Analysis

  • max time kernel
    124s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19-01-2022 15:38

General

  • Target

    QUOTE REQUEST.xlsx

  • Size

    182KB

  • MD5

    a3b0f2e67c366b258a9ddfec341c3c0c

  • SHA1

    e6c2de510b1b4c350f5685516c591675ac118a33

  • SHA256

    a9a5c68fb949f64d790a9ccf2a0d3831fe4aa61c8497e59af00693eb3e2fb4a1

  • SHA512

    2bd56d11e14712a6bc5ac4bee4564c23de9b3ac5bf2e59fa8cc8fecb166d6ee743c8126576b5ade97618b54b0e3065ab0d95c4befe33974fffd617fac145b869

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\QUOTE REQUEST.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3988-130-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB

  • memory/3988-131-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB

  • memory/3988-132-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB

  • memory/3988-133-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB

  • memory/3988-134-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB

  • memory/3988-137-0x00007FFF65690000-0x00007FFF656A0000-memory.dmp
    Filesize

    64KB

  • memory/3988-138-0x00007FFF65690000-0x00007FFF656A0000-memory.dmp
    Filesize

    64KB

  • memory/3988-181-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB

  • memory/3988-182-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB

  • memory/3988-183-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB

  • memory/3988-184-0x00007FFF676F0000-0x00007FFF67700000-memory.dmp
    Filesize

    64KB