Resubmissions
19/09/2023, 05:26
230919-f48ylafa5y 119/09/2023, 05:23
230919-f24k4afa5t 119/09/2023, 05:03
230919-fpsm3aeh8t 119/09/2023, 04:59
230919-fmqqpaeh6x 119/09/2023, 04:47
230919-fenlcsgh93 6Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
19/09/2023, 05:23
General
-
Target
Cyber-Security-Risk-Assessment-Checklist.xlsm
-
Size
2.4MB
-
MD5
84e43ceb986a39ff1380981d49c44bf8
-
SHA1
1dd3905867402c113d4451bb7dbc43f6f527ac01
-
SHA256
86469bcb1253f04fb7d982c0ece648ce2669d69c5fa4a902cfd8d7e431473dfc
-
SHA512
cc698516543350145f560ea06f137d9498bd4e2662a24e5c359831c8d55e09fd3c6f1e62e225a07cf3ef5a619de190790a0bd20092b3df9a99717f44aaad446b
-
SSDEEP
49152:34eo+vAhocukoyv9W7twhyubLXQ/zVdzsvPeAlCQQO0BA80aed:3rHvkbvI7zkmvzsvPeoC1Bid
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 9 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 28 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Cyber-Security-Risk-Assessment-Checklist.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5198021ef96f9fd526b2ca6ae8b7940fc
SHA1b010f8fc29b76c59f0a0d37b7fbd29d2d5cddfd8
SHA2565683fa2da121a7e379022244b5ffb777f6c97db4b95e71e5d28e4bde53b35cfc
SHA512e7f00c7d7817f826881bbe493b810a7f1258b06503a5fbfacb6184aae019e099d02221d3cde671c117a37d99df60536bd759987942bd9254bbdb1b0fe65107a9
-
Filesize
76B
MD50f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1242755226012b4449a49b45491c0b1538ebf6410
SHA256385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
SHA512a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
-
Filesize
76B
MD50f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1242755226012b4449a49b45491c0b1538ebf6410
SHA256385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
SHA512a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
-
Filesize
52KB
MD573a6a1c1939c59e5d38a429004305aed
SHA145005a10ad519323ba87e5c9871b90593d4a5a7e
SHA2561a99e967f48933281ff0cd50d85663e209ae3d6c68790295a6a4e0c00c9c9c93
SHA51266f6f10cc041c556e723983ac81249608608559aa04a031e4feb9b7bc21a46f4c1f61cdbce9119409f45c3f3e8bc633e4f1e5e326a1f238d9423b03d01ff4736
-
Filesize
56KB
MD57626353e79770237ba381a817277f6e2
SHA19f2b8449f72be2e806b996bdec8c52edbddda812
SHA25685fc7bdacbf14c4da4ea292c82c88eea884ccc96fdcfea4dddbdc081d4b9390a
SHA512b7e819010a373ec27e84787017148e65142965b43d763503bfdda0c001e3a75811aa422910475f9fa95a7a2f650fdf873b6d03c4c76dd0e1f27640d6a1ba6cbf
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
8.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB