10cd503b6c49730790ce9f231827e3b48a0ab39e0327d9fe4fbd1f8a5502401e

Analysis

max time kernel
102s
max time network
34s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

EM1QO2xJcweQzp8jGCfjtIoKs.xll
Size

670KB
MD5

73cad3204857e53193f69709c22bd3e7
SHA1

6f7ce5552fddeb8cbacab93d4aabf53ef5397722
SHA256

10cd503b6c49730790ce9f231827e3b48a0ab39e0327d9fe4fbd1f8a5502401e
SHA512

3daba15ae35419b92564008a74b72f43500f13a2b988dc50b766802822d6ea7875b151d5be2a3d2a591dd929d9c28489b22b5d490afe9ad47dc103106f3098c7
SSDEEP

12288:cn/zDvGHAykHSzLW/4+8bzbBSreMdhhgFK/UqWcskW570vY0:uzbGHAzHAjX1UcLzH5gw

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2352	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2352	EXCEL.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\EM1QO2xJcweQzp8jGCfjtIoKs.xll
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\EM1QO2xJcweQzp8jGCfjtIoKs.xll

Filesize
192KB

MD5
b94a0734ee1fa80efdd34d64ce3cdd48

SHA1
539b2e82599084067f83ec978de8a989ac737222

SHA256
c3df9a0688285dea2d5c2848b8229e557070ee2db823100d7d7ff6391d354de8

SHA512
4dfa0c3898e645c633d67afd692b448fd68ae0b6be6ebca2844911e9949e9897952512a6f66e4fb2f75b1222ac1a465fba9400e3da54a6bc4dc2fbb5ec39ca12

Download Submit
memory/2352-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2352-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download