211dafb1508c0dd5af66552f5cc705aaf337ca4cf5b0220342df326702098918

Analysis

max time kernel
135s
max time network
130s
platform
windows10_x64
resource
win10v20201028
submitted
09-03-2021 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1611.xls
Size

57KB
MD5

008a38a3ae5a52bff9ac3be0357619c8
SHA1

d6ecd65769eb8ff1dbf7cfd80d3dee53dfc43e32
SHA256

211dafb1508c0dd5af66552f5cc705aaf337ca4cf5b0220342df326702098918
SHA512

6b4a8f024b7e76d6c8a81ca8e7aee40ea1d1b7959e13b18ab84685334930213ea5d4d2d330d2dbe0fd1d84cc6765402e73d9270fca6804290c47e5c77e7931eb

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1908 EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

EXCEL.EXE

pid	process
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1611.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-2-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmp

Filesize
64KB

Download
memory/1908-3-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmp

Filesize
64KB

Download
memory/1908-4-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmp

Filesize
64KB

Download
memory/1908-5-0x00007FFCA1FA0000-0x00007FFCA25D7000-memory.dmp

Filesize
6.2MB

Download
memory/1908-6-0x00007FFC7E0E0000-0x00007FFC7E0F0000-memory.dmp

Filesize
64KB

Download