Analysis
-
max time kernel
67s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-03-2021 18:07
Behavioral task
behavioral1
Sample
751537.xls
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
751537.xls
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
751537.xls
-
Size
57KB
-
MD5
27273577ddd3e70dc746291e42f626bc
-
SHA1
610e0e80bc736bd90b4e591040733ccc6e9d445c
-
SHA256
9b5e345b95e02a06bc8db95a0120cd8b9e178339d9e60ea597f1252d15a87977
-
SHA512
e0cdefc50db19687986b8f2a1d6ac858b74ae33d8c6de554021c468a2609de9ea94ad10e42356ce196867da04087ea81b7dcb7f7e21eaf54d21bf5dbf2cd127a
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 776 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 36 IoCs
Processes:
EXCEL.EXEpid process 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\751537.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx