Behavioral Report

Analysis

max time kernel
150s
max time network
153s
platform
windows10_x64
resource
win10v20201028
submitted
13-11-2020 17:00

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

document-1695943537.xlsb
Size

291KB
MD5

b28ef08d375ad06a81a8ca98d5fc96dc
SHA1

ab02b99078e51a8cd1a8e38c47d9ac5595fec982
SHA256

bbec9c22ae3f670c9c969c6c45ca674231a250789c4cd24eb39ffd7734fd499d
SHA512

68575fc13ddf0a01c14611837004af15b017ce2de53eb9ef1bef90e43c419073b2ad13c181a3819f95c3628421558b245c63f90a39095aeb213db6d7e61ed036

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

636 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE
636	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1695943537.xlsb"

Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx

PID:636

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Query Registry

T1012

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/636-0-0x00007FFA00770000-0x00007FFA00DA7000-memory.dmp

Filesize
6MB

Download