94638a0b791ad1d06fefc2ff2ec1832af3f73deb01bff6e316c2bcd2fac22a6a

Analysis

max time kernel
106s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
05-07-2022 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ĐƠN HÀNG DỰ ÁN MỚI 2022.xlsx
Size

176KB
MD5

0612e8a9736120eb9e28cd50233d9448
SHA1

542e0777b397994b90809ecb5b95362d67bb71cd
SHA256

94638a0b791ad1d06fefc2ff2ec1832af3f73deb01bff6e316c2bcd2fac22a6a
SHA512

65d42b47b1afa82b0de3d8f35cb891a55f432eb5a48afd2f527736917a947d97bafabd6f91bc093250a3b9d226116a01a8abcf704bf36167492ad81a74a45b42

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1384 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE
1384	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ĐƠN HÀNG DỰ ÁN MỚI 2022.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-130-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/1384-131-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/1384-132-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/1384-133-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/1384-134-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/1384-135-0x00007FFE35080000-0x00007FFE35090000-memory.dmp

Filesize
64KB

Download
memory/1384-136-0x00007FFE35080000-0x00007FFE35090000-memory.dmp

Filesize
64KB

Download
memory/1384-138-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/1384-139-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/1384-140-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/1384-141-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download