Analysis

  • max time kernel
    150s
  • max time network
    107s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 19:36

General

  • Target

    3352d8d6c5acb1dbb5a0b9eab250c344.xls

  • Size

    140KB

  • MD5

    3352d8d6c5acb1dbb5a0b9eab250c344

  • SHA1

    08f5f80fd164152fc1dc9f70b77e4e7651820c98

  • SHA256

    0996805f4f8b09a435b7e9bdf28bcaaa5121fba41028fd35a509a3ea4ca91180

  • SHA512

    76ff7f8f04d9c582872597d2ea629afcca68ff7e473aea167e253e37e624e1f30c6109c9983a865acda1eda400dfbfb05b56168249f002805be46ca0b2fd7bda

  • SSDEEP

    3072:orxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAiWpnUXB7pqkCkG+jrU91z+M/7OmmwUZ:ixEtjPOtioVjDGUU1qfDlavx+W2QnAXi

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\3352d8d6c5acb1dbb5a0b9eab250c344.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1776-54-0x000000002FDE1000-0x000000002FDE4000-memory.dmp

    Filesize

    12KB

  • memory/1776-55-0x0000000070DB1000-0x0000000070DB3000-memory.dmp

    Filesize

    8KB

  • memory/1776-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1776-57-0x0000000071D9D000-0x0000000071DA8000-memory.dmp

    Filesize

    44KB

  • memory/1776-58-0x0000000074C91000-0x0000000074C93000-memory.dmp

    Filesize

    8KB

  • memory/1776-68-0x0000000071D9D000-0x0000000071DA8000-memory.dmp

    Filesize

    44KB