Analysis

  • max time kernel
    154s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 19:07

General

  • Target

    903aff29b130c7047da714afa2980213dd5661d124eebe3e227f68042527c4a4.xls

  • Size

    10KB

  • MD5

    e4139f4e1835eac42baf5e06879011f1

  • SHA1

    08ecc228415ef7ce1de61311dafde13e2d4606ec

  • SHA256

    903aff29b130c7047da714afa2980213dd5661d124eebe3e227f68042527c4a4

  • SHA512

    bc58ef94ee35db19af19995252d07f8f170cc3c67f94c04f4867f1db0ce0b928016de7eee0535aca4d166c52c6558fafec4ec775a6d75f88758517f84aa7da11

  • SSDEEP

    192:Xop42p42p42t8wth8hhPPPPPPPPPPG8RtFsNV3+PFxq:4BBBt8C3+PFxq

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\903aff29b130c7047da714afa2980213dd5661d124eebe3e227f68042527c4a4.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3064

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3064-132-0x00007FFB54410000-0x00007FFB54420000-memory.dmp

          Filesize

          64KB

        • memory/3064-133-0x00007FFB54410000-0x00007FFB54420000-memory.dmp

          Filesize

          64KB

        • memory/3064-134-0x00007FFB54410000-0x00007FFB54420000-memory.dmp

          Filesize

          64KB

        • memory/3064-135-0x00007FFB54410000-0x00007FFB54420000-memory.dmp

          Filesize

          64KB

        • memory/3064-136-0x00007FFB54410000-0x00007FFB54420000-memory.dmp

          Filesize

          64KB

        • memory/3064-137-0x00007FFB51AB0000-0x00007FFB51AC0000-memory.dmp

          Filesize

          64KB

        • memory/3064-138-0x00007FFB51AB0000-0x00007FFB51AC0000-memory.dmp

          Filesize

          64KB