Analysis

  • max time kernel
    199s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 07:02

General

  • Target

    FORM E CUSTOM CLEARANCE.xls

  • Size

    1.0MB

  • MD5

    5bf6a6355aa87c0b503ac9483bdda694

  • SHA1

    4b66e4a3ce22603d9e58893c33b023ffd1f96713

  • SHA256

    c749595e9a90a739657ba41098f9c3e50324f2199afbc8bedeeca02722645fcc

  • SHA512

    5fea39f477432dfb6c64201b218bf38e9a33ee7ac62f38f0f40b1d34902976cb5de1c7142c6049c51a481aee4bfa029ede63d201a899a01d3f94fa409b7fb6ff

  • SSDEEP

    24576:sr5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXgmhr5XXXXXXXXXXXXUXXXXXXXSXXXXXM:

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\FORM E CUSTOM CLEARANCE.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3304

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3304-132-0x00007FFF0B3F0000-0x00007FFF0B400000-memory.dmp

    Filesize

    64KB

  • memory/3304-134-0x00007FFF0B3F0000-0x00007FFF0B400000-memory.dmp

    Filesize

    64KB

  • memory/3304-133-0x00007FFF0B3F0000-0x00007FFF0B400000-memory.dmp

    Filesize

    64KB

  • memory/3304-135-0x00007FFF0B3F0000-0x00007FFF0B400000-memory.dmp

    Filesize

    64KB

  • memory/3304-136-0x00007FFF0B3F0000-0x00007FFF0B400000-memory.dmp

    Filesize

    64KB

  • memory/3304-137-0x00007FFF08DB0000-0x00007FFF08DC0000-memory.dmp

    Filesize

    64KB

  • memory/3304-138-0x00007FFF08DB0000-0x00007FFF08DC0000-memory.dmp

    Filesize

    64KB