Analysis

  • max time kernel
    141s
  • max time network
    272s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2023 11:23

General

  • Target

    Windows-11-v22H2-Security-Baseline/GPOs/{03A608E1-608B-4ECE-A44E-ACE3AF1ECD8B}/Backup.xml

  • Size

    7KB

  • MD5

    6a0dbbbed20565436252d62a05e53e7b

  • SHA1

    752111058eadc978518d217cef0f6af2ac5970c2

  • SHA256

    a0ab6d8fa6b2dbacb0927018c01f751825a69a02d97d6a07395fdd6cc820039c

  • SHA512

    460ed4666374e4f6fad2fbf6a41a862c4f3c9b6e2074ebba418f7788e180cda76ba22de835b19f5c69e925a3dac73d765e0aee0c0334009af54524c055833fa7

  • SSDEEP

    96:YDdrVGW7Xk5X9X8fkNCV4Yj2V4oA/XhWt03zJR/Nl2NUDw1juKycrSc4kFUJLuIh:9SvSQWtKzv1sJng

Score
1/10

Malware Config

Signatures

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Windows-11-v22H2-Security-Baseline\GPOs\{03A608E1-608B-4ECE-A44E-ACE3AF1ECD8B}\Backup.xml"
    1⤵
      PID:1256

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1256-0-0x00007FF849110000-0x00007FF849120000-memory.dmp

      Filesize

      64KB

    • memory/1256-1-0x00007FF889090000-0x00007FF889285000-memory.dmp

      Filesize

      2.0MB

    • memory/1256-2-0x00007FF886E10000-0x00007FF8870D9000-memory.dmp

      Filesize

      2.8MB

    • memory/1256-3-0x00007FF849110000-0x00007FF849120000-memory.dmp

      Filesize

      64KB

    • memory/1256-4-0x00007FF889090000-0x00007FF889285000-memory.dmp

      Filesize

      2.0MB