68bc931abd7180b6a0489acf0be0a335bd5bc275ce853fb778ca8825549ede25

Analysis

max time kernel
69s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boobsnail_mini_evasion.xlsm
Size

27KB
MD5

0deb5f146ff137c9f296761865c69a6e
SHA1

c107fc53271d295cd3a22e61574c0f27111eb703
SHA256

68bc931abd7180b6a0489acf0be0a335bd5bc275ce853fb778ca8825549ede25
SHA512

e78b1a585a019ed21ce5cf7e9ee7388fbe89985f4fc2452742060a13c54d978777fa25a5be17b899ee5ec7ee613aea8b917cb520a6524422c5bcf43187641980
SSDEEP

768:ovi7WuxUM07hoDMarZxWp/qAWtTPWC8GPpmycPfA:NWMC7hUMaFxWkTW3kMycw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1672	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1672	EXCEL.EXE
1672	EXCEL.EXE
1672	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\boobsnail_mini_evasion.xlsm
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-54-0x000000002F5F1000-0x000000002F5F4000-memory.dmp

Filesize
12KB

Download
memory/1672-55-0x0000000070E41000-0x0000000070E43000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1672-57-0x0000000071E2D000-0x0000000071E38000-memory.dmp

Filesize
44KB

Download
memory/1672-58-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1672-59-0x0000000071E2D000-0x0000000071E38000-memory.dmp

Filesize
44KB

Download