Analysis

  • max time kernel
    152s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 14:20

General

  • Target

    b4c0672704891c561e9af948430d71c8fb1719ee5d130e26143df577f53ce406.xls

  • Size

    36KB

  • MD5

    5f5609ad898d0df50d8a97c273bb63aa

  • SHA1

    e2c62906409344a63fbe539576bad789733aba4f

  • SHA256

    b4c0672704891c561e9af948430d71c8fb1719ee5d130e26143df577f53ce406

  • SHA512

    7163be300200036f4148132cacc85649f4ced3058afedfd07622372dd3e49f31be4fb0e35c5e9e9d476edb43efe4aa7892ebd84a7106a79a82d0ee4c55f002f0

  • SSDEEP

    768:6///I12wzlFl/sEMeapuONmjDpP1VAqbhxmaR22vFItmd8aYNiKydp5VbRuUr8vq:6///I12wzlFl/sEMeapuONmjDpP1VAqz

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\b4c0672704891c561e9af948430d71c8fb1719ee5d130e26143df577f53ce406.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:328
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2024

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/328-54-0x000000002FA11000-0x000000002FA14000-memory.dmp

      Filesize

      12KB

    • memory/328-55-0x0000000071A81000-0x0000000071A83000-memory.dmp

      Filesize

      8KB

    • memory/328-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/328-57-0x0000000072A6D000-0x0000000072A78000-memory.dmp

      Filesize

      44KB

    • memory/328-58-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

      Filesize

      8KB

    • memory/328-61-0x000000006D221000-0x000000006D223000-memory.dmp

      Filesize

      8KB

    • memory/328-62-0x0000000072A6D000-0x0000000072A78000-memory.dmp

      Filesize

      44KB

    • memory/2024-60-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

      Filesize

      8KB