Analysis
-
max time kernel
145s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-05-2022 05:29
General
-
Target
?i=1paolhvhh.xlsm
-
Size
50KB
-
MD5
793c5a832ea9b3c4a225bc96b4449bc2
-
SHA1
168afc78144b659b18b606a26c3e9a6343dd104a
-
SHA256
894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7
-
SHA512
df041addb6c8113b2add5439f8ce258016233a47a13a3d540187872e4ac25fe3ac87b016bb391a703e0cb73189f1720c0e723b6df47ef971238312ed77a9b607
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/RjuiFMp4Fsp/
xlm40.dropper
http://hoatuoiso1.com/replace/fVea/
xlm40.dropper
https://rumkeke.com/wp-admin/A8/
xlm40.dropper
https://www.restaurantgaig.com/wp-includes/HLDoANj/
xlm40.dropper
http://www.grandfurniture.com/thegrandbrands/eGd55tEm9qkPNOhViP/
xlm40.dropper
http://www.hiway91.com/wp-content/Y/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\_i=1paolhvhh.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB