Analysis

  • max time kernel
    151s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 10:01

General

  • Target

    Offene RGn - Oel Hauser.xlsx

  • Size

    10KB

  • MD5

    c29dad6d6ef1763b6aead798840c2b88

  • SHA1

    96b4b8fe7b658914282467848199e3b96586213f

  • SHA256

    2be7fa00b4fc0196a74f449af09d056fb69fb24053bbaaa23f9dbe69df6cfd02

  • SHA512

    0a5153f7fed4fe199b84d5dec04aac311eb283d49d71067feb69b6e4fd4d14a2a04665ae92d635a6636b4f01d47b5edad743bf5b20a2e54e401e378043ef23ac

  • SSDEEP

    192:wc8mVrb3UwUlAJ6+T33WA5wYK8I+xuLxH7MuOLe:wc313FUlAJPT3rOLxHULe

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Offene RGn - Oel Hauser.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4692-132-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB

  • memory/4692-133-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB

  • memory/4692-134-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB

  • memory/4692-135-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB

  • memory/4692-136-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB

  • memory/4692-137-0x00007FF9EC8D0000-0x00007FF9EC8E0000-memory.dmp

    Filesize

    64KB

  • memory/4692-138-0x00007FF9EC8D0000-0x00007FF9EC8E0000-memory.dmp

    Filesize

    64KB

  • memory/4692-140-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB

  • memory/4692-141-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB

  • memory/4692-142-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB

  • memory/4692-143-0x00007FF9EEA10000-0x00007FF9EEA20000-memory.dmp

    Filesize

    64KB