Analysis

  • max time kernel
    138s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2023, 03:13

General

  • Target

    sticker_croissant.xml

  • Size

    13KB

  • MD5

    ae211e218ef12fea06ca73727c4ca673

  • SHA1

    47ee36c4cb7ef593904b899030fb9d5d5ebb3bbb

  • SHA256

    a5d91b82bc2bfc7183b03297b66feab2a1efc1dd1c470dff2389c72143b981ca

  • SHA512

    85f7a9e4949d13f7ebc2404117a5898941a3b85da6b633327d494c3b9f9bd018a0ce183526b92f280a2fa77f2679be21fd66729fba3a51ae0d908bdbb6ce9cdd

  • SSDEEP

    192:ZyqlXexFLRZLx9FaqKYgXOqJ/351KyjfoTDCOQR3Yvxn56HOfu6nljKTCYCTtOR:9lXwRbJKYUOqTsEOQR3YvxJ5nlW2/OR

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\sticker_croissant.xml"
    1⤵
      PID:2528
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2528 -s 448
        2⤵
        • Program crash
        PID:1400
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 404 -p 2528 -ip 2528
      1⤵
        PID:2428

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2528-133-0x00007FFBAF3B0000-0x00007FFBAF3C0000-memory.dmp

        Filesize

        64KB

      • memory/2528-134-0x00007FFBEF330000-0x00007FFBEF525000-memory.dmp

        Filesize

        2.0MB

      • memory/2528-135-0x00007FFBEF330000-0x00007FFBEF525000-memory.dmp

        Filesize

        2.0MB

      • memory/2528-136-0x00007FFBEF330000-0x00007FFBEF525000-memory.dmp

        Filesize

        2.0MB

      • memory/2528-137-0x00007FFBECBB0000-0x00007FFBECE79000-memory.dmp

        Filesize

        2.8MB

      • memory/2528-138-0x00007FFBAF3B0000-0x00007FFBAF3C0000-memory.dmp

        Filesize

        64KB

      • memory/2528-139-0x00007FFBEF330000-0x00007FFBEF525000-memory.dmp

        Filesize

        2.0MB