b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051

Analysis

max time kernel
105s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe
Size

674KB
MD5

b3e6c0c2f858135a7c2c6cee55b5fec5
SHA1

520fb2b740cdd74bc8cb2f0373b9e0061053b930
SHA256

b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051
SHA512

6e1b869912da05bbb1f6782753655e66729db75754c49a21bcc99ea439187d8b84f5e75bcfed6709cd914e381d3522e60f54de635fbb794cee4832c54c049812
SSDEEP

12288:rkMIese06snjBQ+H7Ab/rGIkQos6qcJWe8RI6srnycVP/8M:kTnjB1HQ/rGIkQJLcJiRIl7y6P/8M

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\27DC.tmp	office_macro_on_action

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\TypeLib\{31F2F1D8-FD84-416E-A751-09B345C428D7}\2.0\HELPDIR	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31F2F1D8-FD84-416E-A751-09B345C428D7}\2.0\0\win32	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31F2F1D8-FD84-416E-A751-09B345C428D7}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Excel8.0"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\TypeLib\{31F2F1D8-FD84-416E-A751-09B345C428D7}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Excel8.0"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\TypeLib	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

964 EXCEL.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exeEXCEL.EXE

pid process

1108 b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe
964 EXCEL.EXE
964 EXCEL.EXE
964 EXCEL.EXE

pid	process
964	EXCEL.EXE

pid	process
1108	b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe
964	EXCEL.EXE
964	EXCEL.EXE
964	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe
"C:\Users\Admin\AppData\Local\Temp\b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1108

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:964

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\27DC.tmp
Filesize
642KB

MD5
d21277dd8e43ec031d6509c6a25195b6

SHA1
f552bbc3e0f29dc3a9f6d57637dc21016757b543

SHA256
381ee0715997eca4c13c6beaf4029b2dde80181c4ca61f76639e19f8da1f17dd

SHA512
6b2f858a917bd555533938cd37bad53c3a3b713da920b556cbd070833e65068d0432f14afcc92b4ba1fbaecc7ff5bd2de9a16080304390fd86f3ac3d706c8c07

Download Submit
memory/964-56-0x000000002F801000-0x000000002F804000-memory.dmp

Filesize
12KB

Download
memory/964-57-0x0000000071811000-0x0000000071813000-memory.dmp

Filesize
8KB

Download
memory/964-58-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/964-59-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/964-60-0x00000000727FD000-0x0000000072808000-memory.dmp

Filesize
44KB

Download
memory/964-62-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-63-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-64-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-65-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-67-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-66-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-68-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-69-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-71-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-70-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-73-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-72-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-75-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-74-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-76-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-78-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-77-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-81-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-79-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-80-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-82-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-84-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-85-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-83-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-87-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-86-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-89-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-88-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-91-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-90-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-92-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-93-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-95-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-96-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-97-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-94-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-99-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-98-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-101-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-100-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-103-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-102-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-105-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-107-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-106-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-104-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-108-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-109-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-110-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-112-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-111-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-114-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-113-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-115-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-117-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-116-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-119-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-118-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-120-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-121-0x0000000000595000-0x0000000000599000-memory.dmp

Filesize
16KB

Download
memory/964-122-0x0000000000597000-0x0000000000599000-memory.dmp

Filesize
8KB

Download
memory/964-123-0x00000000727FD000-0x0000000072808000-memory.dmp

Filesize
44KB

Download
memory/964-124-0x0000000000597000-0x0000000000599000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads