5342908790712f84ffc21b76ed6282d4b9762337b6e796952a5a9534a203a4d4

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2022 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5342908790712f84ffc21b76ed6282d4b9762337b6e796952a5a9534a203a4d4.exe
Size

175KB
MD5

4c0648d551159d135b779b529c41da8e
SHA1

22822027060ac1714e07891c775b9ab6612fc6f0
SHA256

5342908790712f84ffc21b76ed6282d4b9762337b6e796952a5a9534a203a4d4
SHA512

12be678c166de5788fc935db67ddc830b5fb85d1a0c984ddb428eea478144c331e519d8cbc918e8f0ec2cca95b02eccd8c9e10c9fc5824356cdf7e9b12c2da42
SSDEEP

3072:xU8WuPqqlVVrYMZft0JPl+haGBGUSyh86mq4OzbH:q8Bn3VUMZ+NovBGbsiOf

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\tmp7709.tmp	office_macro_on_action

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4328 EXCEL.EXE

pid	process
4328	EXCEL.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

5342908790712f84ffc21b76ed6282d4b9762337b6e796952a5a9534a203a4d4.exeEXCEL.EXE

pid	process
2872	5342908790712f84ffc21b76ed6282d4b9762337b6e796952a5a9534a203a4d4.exe
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE
4328	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\5342908790712f84ffc21b76ed6282d4b9762337b6e796952a5a9534a203a4d4.exe
"C:\Users\Admin\AppData\Local\Temp\5342908790712f84ffc21b76ed6282d4b9762337b6e796952a5a9534a203a4d4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2872

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7709.tmp

Filesize
111KB

MD5
c9813fab4c50c418bb73c2564fb43ad9

SHA1
5bb10893c66c8f841817a66a2148e9c77a1bbad9

SHA256
b46144c33c7e820a781d508087e6c08e7859287d7c7ed115532fdb41a12c6a9d

SHA512
ea1498a34622b5d648309978b39c243fc5f39c440b23ef9cb3f0dad571318e979553e55c2eebf5ea5032b9d198f708af4e3af8ac7120abf794827565bed7e61e

Download Submit
memory/4328-134-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/4328-135-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/4328-136-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/4328-137-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/4328-138-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

Filesize
64KB

Download
memory/4328-139-0x00007FFC1F9F0000-0x00007FFC1FA00000-memory.dmp

Filesize
64KB

Download
memory/4328-140-0x00007FFC1F9F0000-0x00007FFC1FA00000-memory.dmp

Filesize
64KB

Download
memory/4328-142-0x000001B43A320000-0x000001B43A324000-memory.dmp

Filesize
16KB

Download