Analysis

  • max time kernel
    107s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2022, 22:13

General

  • Target

    0556_877.xls

  • Size

    91KB

  • MD5

    0e720e872be438cce00c8eded2533ab7

  • SHA1

    742a5817a0c84210f86a170d7a44331bb70f4e53

  • SHA256

    73943b556c0df7640625e6f06669351ffbf7743f840c84fc743caf70702c21cb

  • SHA512

    e5ec29e6cc5483a9702ed821dd59285d996dd489fb3d9df1447a9202bf8bc5f5fb0410407a5885e23c512b735e4bb8875407fa73016180229a424c0e8ca57a38

  • SSDEEP

    1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgIbCXuZH4gb4CEn9J4ZJFQvj:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0556_877.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4324

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4324-132-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB

        • memory/4324-133-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB

        • memory/4324-134-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB

        • memory/4324-135-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB

        • memory/4324-136-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB

        • memory/4324-137-0x00007FF7CA1E0000-0x00007FF7CA1F0000-memory.dmp

          Filesize

          64KB

        • memory/4324-138-0x00007FF7CA1E0000-0x00007FF7CA1F0000-memory.dmp

          Filesize

          64KB

        • memory/4324-140-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB

        • memory/4324-141-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB

        • memory/4324-142-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB

        • memory/4324-143-0x00007FF7CC670000-0x00007FF7CC680000-memory.dmp

          Filesize

          64KB