Analysis
-
max time kernel
1697s -
max time network
1160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
16-11-2023 17:37
General
-
Target
MONITORAMENTO DE RISCO_09.NOV.23.xlsx
-
Size
649KB
-
MD5
0403f10759e9b3ac8fda464304f53ff7
-
SHA1
65890abd343acf964a6afe173d0696e2a0fda5d0
-
SHA256
0cd4000757541f9629a00398daee891f287b5f60245c993be9fd15ff228826ff
-
SHA512
ae0224d82777d6aa746e51dc2b74f591a068a58f8f008ff2e8d003b889458a77eeecf31880f74a8a3b775156139e61ecb2348d9ab9b6f689826c663e8d79723a
-
SSDEEP
12288:nM2Sgz0DEKJjExvqDlZFyG0YZVpQNSU5XsWe8vwCUJFu6bSr:nM2hw/DlZFyG0YZr0XYMwFJohr
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\MONITORAMENTO DE RISCO_09.NOV.23.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD52c725b19dcf42f5e7cbb5b28231dbb4a
SHA17ac821271da51d65d4352f54863b73092ffddf6a
SHA256d3cde21c5e2ed22f8200b426faea34808a0adc0b3074336b36e53255bcedffdc
SHA5129c52ec245618114feb2192d54f02d2f8f8b1af36f493274f3453734bf436ca48d121cafd5b3e11805060c0b147e6e9535df5e87ac8553210cb5f96b50e1e72a8
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB