Overview

overview

8

Static

static

8

c949ebce8a...c8.xls

windows7-x64

1

c949ebce8a...c8.xls

windows10-2004-x64

6

Analysis

  • max time kernel
    153s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 11:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c949ebce8a922eebc0656e8ebc645dd0c2f3261cc06c4814ec56bf306dd301c8.xls

  • Size

    43KB

  • MD5

    fbca40e92e52ff486dcee0faed712d68

  • SHA1

    c79567bc78400009afbd0587d293607f0d4248fd

  • SHA256

    c949ebce8a922eebc0656e8ebc645dd0c2f3261cc06c4814ec56bf306dd301c8

  • SHA512

    4b0734b17e8fea46cdf1ea4539fda32e58ad9b96c3d4806d0edba22d61731ab25b726f98b19191010076587c330f113cd9e109a298e0348215d8f99aba1e6da7

  • SSDEEP

    768:xwwwwGFtbhed56MjbqljrOxX2+Z5wq+C7UdI2R2/2ScBECgZI+t3iRiWgwkI:xwwwwGFtbhed56MjbqljrOxX2+Z5wq+n

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c949ebce8a922eebc0656e8ebc645dd0c2f3261cc06c4814ec56bf306dd301c8.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 7520
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 7520
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:1444

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/208-132-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/208-133-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/208-134-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/208-135-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/208-136-0x00007FF9A0410000-0x00007FF9A0420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/208-137-0x00007FF99E140000-0x00007FF99E150000-memory.dmp
    Filesize

    64KB

    Download
  • memory/208-138-0x00007FF99E140000-0x00007FF99E150000-memory.dmp
    Filesize

    64KB

    Download
  • memory/224-139-0x0000000000000000-mapping.dmp
    Download
  • memory/1444-145-0x0000000000000000-mapping.dmp
    Download