Analysis
-
max time kernel
151s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
11/02/2023, 13:45
General
-
Target
sicherheitsdossier-elektro-v1-1-1.xlsx
-
Size
344KB
-
MD5
6a1bfb1c9ce663efc5d0088dbca79a74
-
SHA1
dafa78493f628ec6c78ded2c66ac750767c51063
-
SHA256
095a7f59456a14aec4bfe5b5c772635201b462a19a534740c0453363fb4156ad
-
SHA512
79e234d3b59a5152e00dafd0e5712ff2adc8fdb8626f0ebb26579d531446905e363ae14022bb0ff19ecc075859b776182f1379545b4c26dfd012183b971ce017
-
SSDEEP
6144:vIdnBp9mjF3HXTNep19C0zCcp6WqaMbxJ/4wnpp:vTjFzNepyzcp9EJ3
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\sicherheitsdossier-elektro-v1-1-1.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB