Analysis
-
max time kernel
109s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
21-09-2022 07:35
General
-
Target
478b8ab875945852f0d6172f99f9d815e74536196c4f155fafda4eb7e32e78f2.xlsm
-
Size
1.9MB
-
MD5
157cd69f8a08b3c2fd9008451f88fd1d
-
SHA1
c9a7359fafa6da6d7795860003d52b23d923f8e5
-
SHA256
478b8ab875945852f0d6172f99f9d815e74536196c4f155fafda4eb7e32e78f2
-
SHA512
729c23592eb3a8ddbf272e420246389ddaf4cb8e125536f4b835f34ef91f5f6a81e8aadd207c646dc8947437a35c76fa6fc2b731a3a91bcb0caff010a12722e8
-
SSDEEP
49152:7u8jnUZKvHbbbbbcgWs370dj2K8z3nftR3IgggggRpFLm/U1G4S6:7nlMZ8z3nftR3IgggggBLSUc4/
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\478b8ab875945852f0d6172f99f9d815e74536196c4f155fafda4eb7e32e78f2.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-