9471b4a150c23f11c783b0bce788511591135dbf42f576de1066031487e9b1d5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9471b4a150c23f11c783b0bce788511591135dbf42f576de1066031487e9b1d5.exe
Size

561KB
MD5

b66cc08fea6c3a38f2e6c4a32fbd7e1e
SHA1

b66b10b1fa9e97da0bd64b4478fd9d05a6dceada
SHA256

9471b4a150c23f11c783b0bce788511591135dbf42f576de1066031487e9b1d5
SHA512

95413c14444c25d87ecdb1db00e182f73b1ede8868933fb7281b8a9bde42d4d198364fb07418078118e27be87074d1b2bd317c07ce823f51ed6b573fafaf81b7
SSDEEP

12288:rkMIz+ZIg7qDs62eEj8G4fNsA2peq8nenbo49NQpHYBJWsMfBE:kz+ZIgmDs6TqaOA2poensU3JWBfBE

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\67A8.tmp	office_macro_on_action

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4700 EXCEL.EXE

pid	process
4700	EXCEL.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

9471b4a150c23f11c783b0bce788511591135dbf42f576de1066031487e9b1d5.exeEXCEL.EXE

pid	process
2344	9471b4a150c23f11c783b0bce788511591135dbf42f576de1066031487e9b1d5.exe
4700	EXCEL.EXE
4700	EXCEL.EXE
4700	EXCEL.EXE
4700	EXCEL.EXE
4700	EXCEL.EXE
4700	EXCEL.EXE
4700	EXCEL.EXE
4700	EXCEL.EXE
4700	EXCEL.EXE
4700	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\9471b4a150c23f11c783b0bce788511591135dbf42f576de1066031487e9b1d5.exe
"C:\Users\Admin\AppData\Local\Temp\9471b4a150c23f11c783b0bce788511591135dbf42f576de1066031487e9b1d5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2344

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\67A8.tmp
Filesize
529KB

MD5
fea334ea85c94ea8babc21fd4cb2a198

SHA1
e0896ce9fc87418dffef8d6d3010004b930f57a6

SHA256
3b507c63d6d5710cceaa4537872d5279f9c0d58da78cf1e2a30cf96043afbf2c

SHA512
1f4df395c55d1b899555cb3b75e57ca02f7dad9879c941a0012993752ffca60152bf60dc4884a61e18d8be29f516e1e8fc4e5c8baf25d6dc1b77a140662f8d65

Download Submit
memory/4700-134-0x00007FF8FD290000-0x00007FF8FD2A0000-memory.dmp

Filesize
64KB

Download
memory/4700-136-0x00007FF8FD290000-0x00007FF8FD2A0000-memory.dmp

Filesize
64KB

Download
memory/4700-135-0x00007FF8FD290000-0x00007FF8FD2A0000-memory.dmp

Filesize
64KB

Download
memory/4700-137-0x00007FF8FD290000-0x00007FF8FD2A0000-memory.dmp

Filesize
64KB

Download
memory/4700-138-0x00007FF8FD290000-0x00007FF8FD2A0000-memory.dmp

Filesize
64KB

Download
memory/4700-139-0x00007FF8FAD20000-0x00007FF8FAD30000-memory.dmp

Filesize
64KB

Download
memory/4700-140-0x00007FF8FAD20000-0x00007FF8FAD30000-memory.dmp

Filesize
64KB

Download
memory/4700-142-0x000001E511160000-0x000001E511164000-memory.dmp

Filesize
16KB

Download