Analysis

  • max time kernel
    252s
  • max time network
    333s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:38

General

  • Target

    17-Sep-2022_421_0730102000XXXXX_625421.xlsx

  • Size

    50KB

  • MD5

    bc39912187b756e05b6098a7660d7425

  • SHA1

    ebbe5c696749ff469055bb95a75bcfdbf4034a2b

  • SHA256

    127f062b56dad566e4c765c2c819ac7be2763d35fac97c3e1f5906d4633795aa

  • SHA512

    6cb6c53235928a36e1ae57207ebc8514c59d88688a4fa398089d968110bdf6fefb43dfa821e312b3853c857019d5776faa0eb1941dd06dea4c6bbcc356611c49

  • SSDEEP

    768:5rwN+CSdm95TYrSDjJ3NCI+v4NGYpNLPzWyFNFwYlr87kuw/SGvkJ8vJ0N:50+ETYr6ZvOyFNFXbLkJ8vJ0N

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\17-Sep-2022_421_0730102000XXXXX_625421.xlsx
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:472

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/472-54-0x000000002F311000-0x000000002F314000-memory.dmp

    Filesize

    12KB

  • memory/472-55-0x0000000070EF1000-0x0000000070EF3000-memory.dmp

    Filesize

    8KB

  • memory/472-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/472-57-0x0000000071EDD000-0x0000000071EE8000-memory.dmp

    Filesize

    44KB

  • memory/472-58-0x00000000757E1000-0x00000000757E3000-memory.dmp

    Filesize

    8KB

  • memory/472-59-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/472-60-0x0000000071EDD000-0x0000000071EE8000-memory.dmp

    Filesize

    44KB