Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2022 21:27

General

  • Target

    2dc726b8aa47616b6315d486dd289ba3.xlsm

  • Size

    17KB

  • MD5

    2dc726b8aa47616b6315d486dd289ba3

  • SHA1

    0823f9ea4079f3c43fd79953bddcaf1a4d939f82

  • SHA256

    4b51506ee5dd8045f193ca519f96505266ce7108897e4ecee134e96bd95f8f54

  • SHA512

    e2401ae3b4e18e857a2330210d153fdbfeb4dcb31ae584b559fe716fac9a58ea98a446d61d9870b2b5a90feb156e9f8da40b6ec5f7f62fba92ded74b92010b75

  • SSDEEP

    384:HeEW2Vk1eKrNHj8f9NdNQQKKEM5CxSMDS2OQxEN7UIFhibbwBHtL:+EW2Vk0MWNMKEMb8TOhAWoXmL

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2dc726b8aa47616b6315d486dd289ba3.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4824

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4824-132-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB

  • memory/4824-133-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB

  • memory/4824-134-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB

  • memory/4824-135-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB

  • memory/4824-136-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB

  • memory/4824-137-0x00007FFF14B60000-0x00007FFF14B70000-memory.dmp

    Filesize

    64KB

  • memory/4824-138-0x00007FFF14B60000-0x00007FFF14B70000-memory.dmp

    Filesize

    64KB

  • memory/4824-140-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB

  • memory/4824-141-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB

  • memory/4824-142-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB

  • memory/4824-143-0x00007FFF16E70000-0x00007FFF16E80000-memory.dmp

    Filesize

    64KB