b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe
Size

674KB
MD5

b3e6c0c2f858135a7c2c6cee55b5fec5
SHA1

520fb2b740cdd74bc8cb2f0373b9e0061053b930
SHA256

b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051
SHA512

6e1b869912da05bbb1f6782753655e66729db75754c49a21bcc99ea439187d8b84f5e75bcfed6709cd914e381d3522e60f54de635fbb794cee4832c54c049812
SSDEEP

12288:rkMIese06snjBQ+H7Ab/rGIkQos6qcJWe8RI6srnycVP/8M:kTnjB1HQ/rGIkQJLcJiRIl7y6P/8M

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7FF3.tmp	office_macro_on_action

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2116 EXCEL.EXE

pid	process
2116	EXCEL.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exeEXCEL.EXE

pid	process
4728	b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe
"C:\Users\Admin\AppData\Local\Temp\b7cbf4b2518ff1aa992bd0f8f8e74c71457c914e2201c74c825669a1352c9051.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4728

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7FF3.tmp
Filesize
642KB

MD5
d21277dd8e43ec031d6509c6a25195b6

SHA1
f552bbc3e0f29dc3a9f6d57637dc21016757b543

SHA256
381ee0715997eca4c13c6beaf4029b2dde80181c4ca61f76639e19f8da1f17dd

SHA512
6b2f858a917bd555533938cd37bad53c3a3b713da920b556cbd070833e65068d0432f14afcc92b4ba1fbaecc7ff5bd2de9a16080304390fd86f3ac3d706c8c07

Download Submit
memory/2116-134-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

Filesize
64KB

Download
memory/2116-136-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

Filesize
64KB

Download
memory/2116-135-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

Filesize
64KB

Download
memory/2116-137-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

Filesize
64KB

Download
memory/2116-138-0x00007FF811CF0000-0x00007FF811D00000-memory.dmp

Filesize
64KB

Download
memory/2116-139-0x00007FF80F3E0000-0x00007FF80F3F0000-memory.dmp

Filesize
64KB

Download
memory/2116-140-0x00007FF80F3E0000-0x00007FF80F3F0000-memory.dmp

Filesize
64KB

Download
memory/2116-142-0x000001EC73010000-0x000001EC73014000-memory.dmp

Filesize
16KB

Download