Analysis
-
max time kernel
139s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 03:09
General
-
Target
清单表/工行阳江分行营业综合用房 (地上部分) 消防工程/工行阳江分行营业�.xls
-
Size
74KB
-
MD5
91ed9e2a0ac7f30f9be794fa101013be
-
SHA1
0f11fed8df96bb5550c7c2d1648f0f7ea72c9c5e
-
SHA256
39f3e967dc222624b68f86bad078d04ddce54b5e82a5790385f087a23def2c54
-
SHA512
a7dc73166ff8ebe16bd5ca30359d474dd6a8fea671844358d088f76e9d234f4382eae52fc1360404868a0cfd1e0a005a3490c9c0a9c60100a7c3ecd5727f90cb
-
SSDEEP
1536:UQP/Aw6YRnFp9v7UUJJJJJJJJTfeyDLbZyKy+9k3exYrWISEgPjI7Zu98t:hv7y+9k3exYrWISEgPO
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\清单表\工行阳江分行营业综合用房 (地上部分) 消防工程\工行阳江分行营业�.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB