Analysis
-
max time kernel
125s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-04-2022 03:11
General
-
Target
?i=1fkjnjjlg.xlsm
-
Size
83KB
-
MD5
cf82eec9632dc53d54c38f1d7b8a1b71
-
SHA1
7b7e3339a8e857f1525341c074571ee7d7e9dd7f
-
SHA256
9fbfeb3873dee627be46cf7c10015435d027d718dd42a7842badd45e590f782b
-
SHA512
346297dc7ce5b9caf84b766e40339372012f3401f010a7473a52cdb9a56027bdef53869a7aa543b67aa890536d442ed718583b04a7328302a164b7dba6f6dd29
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
http://yuanbinglun.com/www.yuanbinglun.com/7kKwqmxRWQK0OLi/
xlm40.dropper
http://laserjetprintersreview.xyz/wp-includes/BJ6yUJ/
xlm40.dropper
http://2021.posadamision.com/wp-admin/IoqaL08/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\_i=1fkjnjjlg.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB