Analysis

  • max time kernel
    129s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/11/2022, 12:43

General

  • Target

    50c846a13fc8b47e58e0b37844d423984da735163dd417819696bc93d94412fd.xls

  • Size

    217KB

  • MD5

    72eb456e0daaacb506d43885ef8e0b65

  • SHA1

    1be4648f7e7866ee91117339b2511b52dcdd1902

  • SHA256

    50c846a13fc8b47e58e0b37844d423984da735163dd417819696bc93d94412fd

  • SHA512

    764773d3c5664cbd1ebce67fd017c92d2c290c214fd9e776ed05e273226293199a31a12279fa98397c7696c4619fcd769f93c6bd5cf887346a2153cbfc11043b

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmG:bbGUMVWlbG

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\50c846a13fc8b47e58e0b37844d423984da735163dd417819696bc93d94412fd.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3772

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3772-115-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

    Filesize

    64KB

  • memory/3772-116-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

    Filesize

    64KB

  • memory/3772-117-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

    Filesize

    64KB

  • memory/3772-118-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

    Filesize

    64KB

  • memory/3772-127-0x00007FFAB7880000-0x00007FFAB7890000-memory.dmp

    Filesize

    64KB

  • memory/3772-128-0x00007FFAB7880000-0x00007FFAB7890000-memory.dmp

    Filesize

    64KB

  • memory/3772-287-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

    Filesize

    64KB

  • memory/3772-288-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

    Filesize

    64KB

  • memory/3772-289-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

    Filesize

    64KB

  • memory/3772-290-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

    Filesize

    64KB