Analysis
-
max time kernel
197s -
max time network
222s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
01-12-2022 10:41
General
-
Target
a8a8dfbdb992f52df91ff8171a9f87ca5b6387c6d73934816891b1367c387dc0.xls
-
Size
55KB
-
MD5
fa8615921a34200f81a4bcf279491027
-
SHA1
8f3c9f1fe3352ccc29b4a4610fe7dfe98e59889e
-
SHA256
a8a8dfbdb992f52df91ff8171a9f87ca5b6387c6d73934816891b1367c387dc0
-
SHA512
0b5655ab81fe23e2636bd77c8729c8bc6c35bae256bcb39bd40aff0fb2ea81b74490946095a36df229ee92b36e7391f7f8534638d195bb3d6acd018e17536624
-
SSDEEP
1536:iJJJlk7xUAreiaL+QD8YI7fgAJLfD6dUhGomQNe1tmd8aYwGl/196RvHP+oxy132:+se1tmC/196RvHP+oxy13gN/MeEaLjGm
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 5 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a8a8dfbdb992f52df91ff8171a9f87ca5b6387c6d73934816891b1367c387dc0.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 97442⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 97443⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 816 -s 96922⤵
- Process spawned unexpected child process
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 816 -ip 8161⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB