Analysis
-
max time kernel
164s -
max time network
270s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
22/07/2023, 20:51 UTC
General
-
Target
GD/Resources/SecretSheet-hd.xml
-
Size
8KB
-
MD5
fd1b8ad2c4307a1ff6a6bcf696b327cf
-
SHA1
491072085cd021ca280485d92e22b5e5bf750251
-
SHA256
e8ab94b4318da1b011e95cd06700fff9adf1a2bd7e20ab72dde7a2496a581035
-
SHA512
57460ebec83aa4ccf75dc3b22cc88a469715a995db1b84d8672b1659f6ac7690fa2365cd9a55f6058fa2c23e679768dc026cebe0363b41d31e6b0597fa82faf7
-
SSDEEP
96:/y+sYkuDXoSYkRvn0cBkYke58JZcYkxd+WpKJYk/NBBQX7Yk/NnHe3Yk8aMK02YM:a80g06LGak+XQ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\GD\Resources\SecretSheet-hd.xml"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4024 -s 4722⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 4024 -ip 40241⤵
Network
-
DNS68.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse -
DNS226.108.222.173.in-addr.arpaRemote address:8.8.8.8:53Request226.108.222.173.in-addr.arpaIN PTRResponse226.108.222.173.in-addr.arpaIN PTRa173-222-108-226deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS88.156.103.20.in-addr.arpaRemote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
DNS59.128.231.4.in-addr.arpaRemote address:8.8.8.8:53Request59.128.231.4.in-addr.arpaIN PTRResponse
-
DNS103.169.127.40.in-addr.arpaRemote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
DNS43.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
DNS158.240.127.40.in-addr.arpaRemote address:8.8.8.8:53Request158.240.127.40.in-addr.arpaIN PTRResponse
-
DNS12.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request12.173.189.20.in-addr.arpaIN PTRResponse
-
DNS161.252.72.23.in-addr.arpaRemote address:8.8.8.8:53Request161.252.72.23.in-addr.arpaIN PTRResponse161.252.72.23.in-addr.arpaIN PTRa23-72-252-161deploystaticakamaitechnologiescom
-
DNS208.194.73.20.in-addr.arpaRemote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5368.32.126.40.in-addr.arpadns
DNS Request
68.32.126.40.in-addr.arpa
-
8.8.8.8:53226.108.222.173.in-addr.arpadns
DNS Request
226.108.222.173.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5388.156.103.20.in-addr.arpadns
DNS Request
88.156.103.20.in-addr.arpa
-
8.8.8.8:5359.128.231.4.in-addr.arpadns
DNS Request
59.128.231.4.in-addr.arpa
-
8.8.8.8:53103.169.127.40.in-addr.arpadns
DNS Request
103.169.127.40.in-addr.arpa
-
8.8.8.8:5343.229.111.52.in-addr.arpadns
DNS Request
43.229.111.52.in-addr.arpa
-
8.8.8.8:53158.240.127.40.in-addr.arpadns
DNS Request
158.240.127.40.in-addr.arpa
-
8.8.8.8:5312.173.189.20.in-addr.arpadns
DNS Request
12.173.189.20.in-addr.arpa
-
8.8.8.8:53161.252.72.23.in-addr.arpadns
DNS Request
161.252.72.23.in-addr.arpa
-
8.8.8.8:53208.194.73.20.in-addr.arpadns
DNS Request
208.194.73.20.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.8MB
-
Filesize
64KB
-
Filesize
2.0MB