Analysis
-
max time kernel
198s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 21:29
Behavioral task
behavioral1
Sample
cb76cff38bf8b3b6104947f2fa5d66b9.xlsm
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cb76cff38bf8b3b6104947f2fa5d66b9.xlsm
Resource
win10v2004-20221111-en
General
-
Target
cb76cff38bf8b3b6104947f2fa5d66b9.xlsm
-
Size
300KB
-
MD5
cb76cff38bf8b3b6104947f2fa5d66b9
-
SHA1
ec682c2c4e64c097ba3612b599e241eb42e2ea4b
-
SHA256
e46f53815fba913eb03caddaa661790330d8f04ced3cdff34fe49cc0b9588386
-
SHA512
b74c75cce75d885d08689fb0f4f44947c23ea8311e75003fac57739ed144225652b0c4c2385c6af366c9fc3d43e3d57006e64e5b32ce5b00ddd66ecc95b130a0
-
SSDEEP
6144:+aL7YOd84NS3Om++HpD6X18mDx8eeNHSVw6Cin8v5tQg4hFtsGK:tM+mhi18GxSOw6C2CV4hFtsGK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cym_16001380430BD84B24.exepid process 1732 cym_16001380430BD84B24.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2788 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
EXCEL.EXEpid process 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE 2788 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2788 wrote to memory of 1732 2788 EXCEL.EXE cym_16001380430BD84B24.exe PID 2788 wrote to memory of 1732 2788 EXCEL.EXE cym_16001380430BD84B24.exe PID 2788 wrote to memory of 1732 2788 EXCEL.EXE cym_16001380430BD84B24.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\cb76cff38bf8b3b6104947f2fa5d66b9.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cym_16001380430BD84B24.exe"C:\Users\Admin\AppData\Local\Temp\cym_16001380430BD84B24.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cym_16001380430BD84B24.exeFilesize
94KB
MD573bc108394db8454fa0acb9e6c6871c4
SHA11f7f62ece551d0c5afee3b63765cdc741c5b5297
SHA256ad0673b26a9195f5752ffe22ba8e4733f4e0a56ea0d1c27c992da2da9f6a0f0f
SHA5125706c8a533526211e0491e43a048b918c6345441f69c07ebc6044167708ad0e43c3b61646155864add0035c206d52280ad83eb660ddcc6fcc8a287d12c0fea42
-
C:\Users\Admin\AppData\Local\Temp\cym_16001380430BD84B24.exeFilesize
94KB
MD573bc108394db8454fa0acb9e6c6871c4
SHA11f7f62ece551d0c5afee3b63765cdc741c5b5297
SHA256ad0673b26a9195f5752ffe22ba8e4733f4e0a56ea0d1c27c992da2da9f6a0f0f
SHA5125706c8a533526211e0491e43a048b918c6345441f69c07ebc6044167708ad0e43c3b61646155864add0035c206d52280ad83eb660ddcc6fcc8a287d12c0fea42
-
memory/1732-139-0x0000000000000000-mapping.dmp
-
memory/2788-132-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmpFilesize
64KB
-
memory/2788-134-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmpFilesize
64KB
-
memory/2788-133-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmpFilesize
64KB
-
memory/2788-135-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmpFilesize
64KB
-
memory/2788-136-0x00007FFFB73D0000-0x00007FFFB73E0000-memory.dmpFilesize
64KB
-
memory/2788-137-0x00007FFFB4A70000-0x00007FFFB4A80000-memory.dmpFilesize
64KB
-
memory/2788-138-0x00007FFFB4A70000-0x00007FFFB4A80000-memory.dmpFilesize
64KB