5c34c14865f4a98f6cc623710e445f479175aeafafcb55614b139fb61cff9de7

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44e65a641fb970031c5efed324676b5018803e0a768608d3e186152102615795.xlsx
Size

2.1MB
MD5

c9ad9506bcccfaa987ff9fc11b91698d
SHA1

e788183a2a021f74a21f609e514bb63c4ef2fe49
SHA256

44e65a641fb970031c5efed324676b5018803e0a768608d3e186152102615795
SHA512

509c7c387810399b4a35371b1ae77733184299ee631f13b70e1582a9bed32c8eebaea79beb8ce7bf07ac8d3fcd7d09fd460a461266e073d6d2e6acc5e3bc68b2
SSDEEP

49152:hEK5fuBxYw1iHM+eP4yFIIFd52Mp21N5xb/CVBqCwj7IjLQc1U4l:SK5f6xYSl+VMy8G5ZC6CCIQc1/l

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

5 1356 EQNEDT32.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1356 EQNEDT32.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2348 EXCEL.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1356 EQNEDT32.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

2348 EXCEL.EXE
2348 EXCEL.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXE

pid process

2348 EXCEL.EXE
2348 EXCEL.EXE
2348 EXCEL.EXE
2348 EXCEL.EXE

flow	pid	process
5	1356	EQNEDT32.EXE

pid	process
1356	EQNEDT32.EXE

pid	process
2348	EXCEL.EXE

pid	process
1356	EQNEDT32.EXE

pid	process
2348	EXCEL.EXE
2348	EXCEL.EXE

pid	process
2348	EXCEL.EXE
2348	EXCEL.EXE
2348	EXCEL.EXE
2348	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\44e65a641fb970031c5efed324676b5018803e0a768608d3e186152102615795.xlsx
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2348

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Launches Equation Editor
- Suspicious behavior: GetForegroundWindowSpam
PID:1356

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-4-0x0000000009BB0000-0x0000000009BB1000-memory.dmp

Filesize
4KB

Download
memory/1356-6-0x0000000009BB0000-0x0000000009BB1000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x000000007322D000-0x0000000073238000-memory.dmp

Filesize
44KB

Download
memory/2348-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2348-5-0x000000007322D000-0x0000000073238000-memory.dmp

Filesize
44KB

Download