Analysis

  • max time kernel
    169s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16/06/2022, 09:40

General

  • Target

    QvtGA0YrRh9C60LAueGxzeA==?=.xlsx

  • Size

    10KB

  • MD5

    61822d2d7da9613771ffc5fcb76d467d

  • SHA1

    d4681e9afd2c843b7828ff715995c0768ef4ef4c

  • SHA256

    a3179c79c2e79c41ff4a3ae307c65e1b50780235661a238afcba75365bb9ce5f

  • SHA512

    72e8ffb8a584550430e78e49aa4ed0ecd41bfc2933d787fc945a839c884d92885ce3d8b3dcff0b45a809316ed71d6189bc85a920956c033bcb941e32de635a92

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\QvtGA0YrRh9C60LAueGxzeA==_=.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2260

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2260-132-0x00007FFDF0DB0000-0x00007FFDF0DC0000-memory.dmp

          Filesize

          64KB

        • memory/2260-131-0x00007FFDF0DB0000-0x00007FFDF0DC0000-memory.dmp

          Filesize

          64KB

        • memory/2260-130-0x00007FFDF0DB0000-0x00007FFDF0DC0000-memory.dmp

          Filesize

          64KB

        • memory/2260-134-0x00007FFDF0DB0000-0x00007FFDF0DC0000-memory.dmp

          Filesize

          64KB

        • memory/2260-133-0x00007FFDF0DB0000-0x00007FFDF0DC0000-memory.dmp

          Filesize

          64KB

        • memory/2260-135-0x00007FFDEEC20000-0x00007FFDEEC30000-memory.dmp

          Filesize

          64KB

        • memory/2260-136-0x00007FFDEEC20000-0x00007FFDEEC30000-memory.dmp

          Filesize

          64KB