7f58013ac38b55147ce4c1af67929739261553b24b5e6f252cce34b25c0794f0

Analysis

max time kernel
139s
max time network
115s
platform
windows10_x64
resource
win10v200410
submitted
15-04-2020 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f58013ac38b55147ce4c1af67929739261553b24b5e6f252cce34b25c0794f0.xls
Size

187KB
MD5

fa3c123b8ce59a7ddc50085ea9babb88
SHA1

f353828ca44e8c90f8eddf28bef0175dd07eaef8
SHA256

7f58013ac38b55147ce4c1af67929739261553b24b5e6f252cce34b25c0794f0
SHA512

0cefd48b46ec825d3c91b178db069bcbf06739ccfadf7c0344e700b0fbdfc4cbd3a7a155b801a758f0c0aaccfce3da29f4aaff57d45176254b1b042a0699271e

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4008	EXCEL.EXE
4008	EXCEL.EXE
4008	EXCEL.EXE
4008	EXCEL.EXE
4008	EXCEL.EXE
4008	EXCEL.EXE
4008	EXCEL.EXE
4008	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4008	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7f58013ac38b55147ce4c1af67929739261553b24b5e6f252cce34b25c0794f0.xls"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:4008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads