52ad780e49a347e9ed1bb92a254b0c695d56c768263ca33ca16ade9bc0285a7a

Analysis

max time kernel
216s
max time network
231s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52ad780e49a347e9ed1bb92a254b0c695d56c768263ca33ca16ade9bc0285a7a.exe
Size

561KB
MD5

6771562a2df9dfd34922a4a8975ff146
SHA1

3cbec281d7427f5e770eaaaa37a6b861676eea0e
SHA256

52ad780e49a347e9ed1bb92a254b0c695d56c768263ca33ca16ade9bc0285a7a
SHA512

b0918a5b0e3387ee025ebf5685f9013e7b221a395da2d50565d7e65e2079f38c038757d01b37ccabd14d600091a7183c936d627707c87adf82838989d8257d5a
SSDEEP

12288:rkMIz+ZIg7qDs62eEj8G4fNsA2peq8nenbo49NQpHYBJWsMfB/:kz+ZIgmDs6TqaOA2poensU3JWBfB/

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp	office_macro_on_action

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2876 EXCEL.EXE

pid	process
2876	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

52ad780e49a347e9ed1bb92a254b0c695d56c768263ca33ca16ade9bc0285a7a.exeEXCEL.EXE

pid	process
4572	52ad780e49a347e9ed1bb92a254b0c695d56c768263ca33ca16ade9bc0285a7a.exe
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE
2876	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\52ad780e49a347e9ed1bb92a254b0c695d56c768263ca33ca16ade9bc0285a7a.exe
"C:\Users\Admin\AppData\Local\Temp\52ad780e49a347e9ed1bb92a254b0c695d56c768263ca33ca16ade9bc0285a7a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9CCC.tmp
Filesize
529KB

MD5
936ac3e0861b942b73a876e5edb4de12

SHA1
22e52f254d2ea67b2bddb333a840a86a0c986b6a

SHA256
d14cfa0fb03e60d8f52525c9d3924d9388306af3e7318bd5f1ced38e1ae5257a

SHA512
861972d0b27572f5934e08e2748d1214babb0e5ac42981b9b3dbab02e04a37ffd860b0f185ee25d81b4e82ac4c90732d2ac148b803c56dea9521218471c55bf0

Download Submit
memory/2876-134-0x00007FFE5C9B0000-0x00007FFE5C9C0000-memory.dmp

Filesize
64KB

Download
memory/2876-135-0x00007FFE5C9B0000-0x00007FFE5C9C0000-memory.dmp

Filesize
64KB

Download
memory/2876-136-0x00007FFE5C9B0000-0x00007FFE5C9C0000-memory.dmp

Filesize
64KB

Download
memory/2876-137-0x00007FFE5C9B0000-0x00007FFE5C9C0000-memory.dmp

Filesize
64KB

Download
memory/2876-138-0x00007FFE5C9B0000-0x00007FFE5C9C0000-memory.dmp

Filesize
64KB

Download
memory/2876-139-0x00007FFE5A850000-0x00007FFE5A860000-memory.dmp

Filesize
64KB

Download
memory/2876-140-0x00007FFE5A850000-0x00007FFE5A860000-memory.dmp

Filesize
64KB

Download
memory/2876-142-0x000001FBBD570000-0x000001FBBD574000-memory.dmp

Filesize
16KB

Download