Resubmissions

03/10/2023, 11:27

231003-nkh7tsca93 8

03/10/2023, 11:15

231003-ncngksca26 8

Analysis

  • max time kernel
    70s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2023, 11:15

General

  • Target

    c9ae9e6bed2bf50de1a90e3590e53926bd7618c4b120eb389df3e7b6ffa752eb.xls

  • Size

    4.8MB

  • MD5

    5684e72ea4350941468709135bc775e0

  • SHA1

    c8249904e5081a3b80a5a3723c7015ecb8d7500f

  • SHA256

    c9ae9e6bed2bf50de1a90e3590e53926bd7618c4b120eb389df3e7b6ffa752eb

  • SHA512

    427ba3f3def779bb07d32ea1cbc0d78c13d7f082b7d245f4e1d0ca9987a111ffd0c494842c21a4ed4042740067c8676fb121dec669bf5844c0a9112799704ace

  • SSDEEP

    98304:Tv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX/:TvpvFa+g8RWLdPk/84tCEr0RtNiC5eSe

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\c9ae9e6bed2bf50de1a90e3590e53926bd7618c4b120eb389df3e7b6ffa752eb.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1988-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1988-1-0x000000007232D000-0x0000000072338000-memory.dmp

    Filesize

    44KB

  • memory/1988-3-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-5-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-4-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-6-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-7-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-8-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-9-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-10-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-11-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-13-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-12-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-254-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-255-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-256-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-257-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-258-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-260-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-259-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-261-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-262-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-263-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-264-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-266-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-265-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-267-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-271-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-270-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-272-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-273-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-268-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-274-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-269-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-275-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-302-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-508-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-509-0x000000007232D000-0x0000000072338000-memory.dmp

    Filesize

    44KB

  • memory/1988-547-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-768-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-1203-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-1204-0x0000000007B40000-0x0000000007D40000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-1205-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-1206-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-1209-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-1428-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-1440-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-1459-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-2115-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-2140-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-2389-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-2390-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-2391-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-2392-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB

  • memory/1988-2393-0x0000000000680000-0x0000000000780000-memory.dmp

    Filesize

    1024KB

  • memory/1988-2394-0x0000000005A10000-0x0000000005E10000-memory.dmp

    Filesize

    4.0MB