ed96d9fffb16a7d241bc09a8fa10f20824859a0c56973fd74ef17e58c242ba33

Analysis

max time kernel
114s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2022 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed96d9fffb16a7d241bc09a8fa10f20824859a0c56973fd74ef17e58c242ba33.exe
Size

317KB
MD5

ef74732f025a9a423a9c2338b0d9b892
SHA1

028f85386287db7e0e0357a41974b60936492f0a
SHA256

ed96d9fffb16a7d241bc09a8fa10f20824859a0c56973fd74ef17e58c242ba33
SHA512

8d466bde5298646905c3ef9d94c1f34fc37f94b1bcd4d0aa544a1b83d547c8ad622347347d4ef7b9bdeeeac216c26b8b67f680292984b64ddc9a29af3e532296
SSDEEP

3072:NVpRMSgIidZ7+7l4+9XflZ6Rf42li7Ln0aWhhw245p9ktIwFj9wXvaoKrGG1k67m:NV9EAaeP+unlWhB4jJTeXS

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\tmp690F.tmp	office_macro_on_action

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

916 EXCEL.EXE

pid	process
916	EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

ed96d9fffb16a7d241bc09a8fa10f20824859a0c56973fd74ef17e58c242ba33.exeEXCEL.EXE

pid	process
4464	ed96d9fffb16a7d241bc09a8fa10f20824859a0c56973fd74ef17e58c242ba33.exe
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\ed96d9fffb16a7d241bc09a8fa10f20824859a0c56973fd74ef17e58c242ba33.exe
"C:\Users\Admin\AppData\Local\Temp\ed96d9fffb16a7d241bc09a8fa10f20824859a0c56973fd74ef17e58c242ba33.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4464

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp690F.tmp
Filesize
221KB

MD5
3ab7e5a7fa71e92e84ba303ee0c26ed9

SHA1
bdbd678ac6f4ef93955605fc280bd46090251c3b

SHA256
15fa7d52e996bd2d4a4f874fb60308a646b5de181c24b0aa34f6954227832a3c

SHA512
b05713850f7d3010185e74956804c4604ce4828111a006b4b81c4616a335b28f80ac5fb83d9d81f26b6afa04df80dac0987023360f6ded3417cf3e18a0bb22c2

Download Submit
memory/916-134-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/916-135-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/916-136-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/916-137-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/916-138-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/916-139-0x00007FFA55FB0000-0x00007FFA55FC0000-memory.dmp

Filesize
64KB

Download
memory/916-140-0x00007FFA55FB0000-0x00007FFA55FC0000-memory.dmp

Filesize
64KB

Download
memory/916-143-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/916-144-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/916-145-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download
memory/916-146-0x00007FFA58010000-0x00007FFA58020000-memory.dmp

Filesize
64KB

Download