027e886037f6a4bcd477ccd27801739b2e45666814a7f20f00b15722b3bbcea7

Analysis

max time kernel
202s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

027e886037f6a4bcd477ccd27801739b2e45666814a7f20f00b15722b3bbcea7.exe
Size

641KB
MD5

d12f7e229ac31e11ffa569c84c71b056
SHA1

63875568676cbc5a6ec32261a80d7a2c77cc7237
SHA256

027e886037f6a4bcd477ccd27801739b2e45666814a7f20f00b15722b3bbcea7
SHA512

780aca7b445f5300ce91a60aa6ea548fa0551454942b97762f466a47930a56500116d3040cbc6827d303c9adb597c73fa359d692a75bd47ba1df98009455abf6
SSDEEP

12288:rXhciSUMvD8wJ/J7M/SF7G0JT7npZmXSfYveGB19Jg/qEgqR:DNoDVHHJG0JT7npRGeW3Jg/qEgqR

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Tmp46BD.tmp	office_macro_on_action

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3728 EXCEL.EXE
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

027e886037f6a4bcd477ccd27801739b2e45666814a7f20f00b15722b3bbcea7.exeEXCEL.EXE

pid process

4200 027e886037f6a4bcd477ccd27801739b2e45666814a7f20f00b15722b3bbcea7.exe
3728 EXCEL.EXE
3728 EXCEL.EXE
3728 EXCEL.EXE
3728 EXCEL.EXE

pid	process
3728	EXCEL.EXE

pid	process
4200	027e886037f6a4bcd477ccd27801739b2e45666814a7f20f00b15722b3bbcea7.exe
3728	EXCEL.EXE
3728	EXCEL.EXE
3728	EXCEL.EXE
3728	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\027e886037f6a4bcd477ccd27801739b2e45666814a7f20f00b15722b3bbcea7.exe
"C:\Users\Admin\AppData\Local\Temp\027e886037f6a4bcd477ccd27801739b2e45666814a7f20f00b15722b3bbcea7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tmp46BD.tmp

Filesize
569KB

MD5
4883dd3603616be4aaeed185d6aff12e

SHA1
a57c4c30dfe99a2c7ce6d822800c61a7c850053f

SHA256
0c60736929713723dcd1d757c6adb1df78b6558164108d8fc400772c14902e18

SHA512
ee08b08aefe783ef158291935a213b18735e464250bfedd806414a7d20c8cf65225972d5f1bfc2a8309082a90c38d567a54eb47662859e6448dd2305163ec479

Download Submit
memory/3728-134-0x00007FFAC2D90000-0x00007FFAC2DA0000-memory.dmp

Filesize
64KB

Download
memory/3728-135-0x00007FFAC2D90000-0x00007FFAC2DA0000-memory.dmp

Filesize
64KB

Download
memory/3728-136-0x00007FFAC2D90000-0x00007FFAC2DA0000-memory.dmp

Filesize
64KB

Download
memory/3728-137-0x00007FFAC2D90000-0x00007FFAC2DA0000-memory.dmp

Filesize
64KB

Download
memory/3728-138-0x00007FFAC2D90000-0x00007FFAC2DA0000-memory.dmp

Filesize
64KB

Download
memory/3728-139-0x00007FFAC0890000-0x00007FFAC08A0000-memory.dmp

Filesize
64KB

Download
memory/3728-140-0x00007FFAC0890000-0x00007FFAC08A0000-memory.dmp

Filesize
64KB

Download