Analysis
-
max time kernel
137s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07-11-2022 20:24
General
-
Target
52c5faae0a0b7e0a25afe6510d699ccdf5c8b27cbd2f2e8e6d9d79cdb5cfaf90.xlsm
-
Size
124KB
-
MD5
f36a5f36f85da7b82b6caa0234882a89
-
SHA1
caa4a70137b34395e93cb01c761392e6d34ce813
-
SHA256
52c5faae0a0b7e0a25afe6510d699ccdf5c8b27cbd2f2e8e6d9d79cdb5cfaf90
-
SHA512
1c7b813bc926533174f5a0b82b2bc4479af2c2739f5cb65ceb353ad37c3a2ae8ebbc299f44d093a29f765b5e23f855c823a79cd0634f7e168636d8f69a979b7a
-
SSDEEP
3072:EE1k8B2YWDldNCQV1F1mFiNWoTvfuAg0LbhL0:EZc2Y+lvNV1v0irTv2AfLtw
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\52c5faae0a0b7e0a25afe6510d699ccdf5c8b27cbd2f2e8e6d9d79cdb5cfaf90.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB