Analysis

  • max time kernel
    135s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16/06/2022, 09:40

General

  • Target

    RFQ_ITEMS.xlsx

  • Size

    714KB

  • MD5

    392ad9f585c56d59ed7c38f0f1fd0248

  • SHA1

    6612bc1b3efcd1768ab97295c939484d1de5a2e2

  • SHA256

    b23af2441730b31e7c5c5e358eb4f2a52929d14546d4cdc3bb203060d069769a

  • SHA512

    37404e0a915029a528099903b10ff7196712e4b7b16b972f06cb441b72fd728be739f8d39984d0f45d9e0d89d01f31d448d6475ffbfcfc4d58403613ce71cd2f

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RFQ_ITEMS.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2224

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2224-130-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB

        • memory/2224-131-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB

        • memory/2224-133-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB

        • memory/2224-132-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB

        • memory/2224-134-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB

        • memory/2224-135-0x00007FF8CDFC0000-0x00007FF8CDFD0000-memory.dmp

          Filesize

          64KB

        • memory/2224-136-0x00007FF8CDFC0000-0x00007FF8CDFD0000-memory.dmp

          Filesize

          64KB

        • memory/2224-139-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB

        • memory/2224-138-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB

        • memory/2224-141-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB

        • memory/2224-140-0x00007FF8D0890000-0x00007FF8D08A0000-memory.dmp

          Filesize

          64KB