Analysis
-
max time kernel
167s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20-10-2022 13:20
General
-
Target
df35f80c0e3ddd8055043963cafeebcafd88e8dd17f48475ef8942d6b79301e0.xls
-
Size
633KB
-
MD5
80f509932ce5fd8b58a42bf0eddf5250
-
SHA1
2d02e2548864289956d71ac28657d5f6d1e40447
-
SHA256
df35f80c0e3ddd8055043963cafeebcafd88e8dd17f48475ef8942d6b79301e0
-
SHA512
1d43b6b1a03458ac6ea478925489f5c2a66877d1a9690be516ebd236e2100e5275213fd7e7581df6fca3e768ae0e8bc883d78314f48fb65b5e775b77870efe6f
-
SSDEEP
3072:uyJLmlL7018jpIPFNHfcMSu/qp4AJr4DfatFRKPeSRC+TC79fHNo2f3Rioc5aw0T:l3744AcKuRC+29fNV3s4tkafL5pr
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\df35f80c0e3ddd8055043963cafeebcafd88e8dd17f48475ef8942d6b79301e0.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB