Analysis
- max time kernel
153s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/06/2022, 06:23
General
- Target MONTHLY SOA AGENT MAR-MAY.xlsx
- Size 181KB
- Sample220616-g5f5mshfa2
- SHA256 3d0b051be972c82b4cce6dc0e6c79642acfe287c490b5072521dab13ab530f73
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\MONTHLY SOA AGENT MAR-MAY.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3032-130-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp
memory/3032-132-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp
memory/3032-131-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp
memory/3032-133-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp
memory/3032-134-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp
memory/3032-135-0x00007FFC474A0000-0x00007FFC474B0000-memory.dmp
memory/3032-136-0x00007FFC474A0000-0x00007FFC474B0000-memory.dmp
memory/3032-138-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp
memory/3032-139-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp
memory/3032-140-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp
memory/3032-141-0x00007FFC49CD0000-0x00007FFC49CE0000-memory.dmp