Analysis

  • max time kernel
    100s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 18:47

General

  • Target

    PO.xlsx

  • Size

    14KB

  • MD5

    afb6307bf393aff2ba6e8b8c0199ff89

  • SHA1

    51868fcf5f7c73937fd075fe25ffc191ac41c6c9

  • SHA256

    4c81af66f036af9fdc5a53acc90b91d5e0a369978e5d186847bce31b52dc7484

  • SHA512

    49c6ed8128b2f04177960477eb4995ebee8fa59537da1f94b599e16a4b3f6faf30a44bb63bdc51dbba99dcaa9632066e5d2af81321efbbde5de774be66e5c80d

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PO.xlsx
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1032
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Launches Equation Editor
    PID:1188

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1032-54-0x000000002FBC1000-0x000000002FBC4000-memory.dmp
    Filesize

    12KB

  • memory/1032-55-0x0000000070F41000-0x0000000070F43000-memory.dmp
    Filesize

    8KB

  • memory/1032-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1032-57-0x0000000071F2D000-0x0000000071F38000-memory.dmp
    Filesize

    44KB

  • memory/1032-58-0x0000000075541000-0x0000000075543000-memory.dmp
    Filesize

    8KB

  • memory/1032-60-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB