Analysis
-
max time kernel
136s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 06:09
Static task
static1
Behavioral task
behavioral1
Sample
PR_A1191-04052021.xlsx
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PR_A1191-04052021.xlsx
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
PR_A1191-04052021.xlsx
-
Size
2.1MB
-
MD5
7c87ef46e0285586d13ae8c4837b43b2
-
SHA1
34e125247aee2ff663f7fcae715dc87dc08f8ee9
-
SHA256
bd7c85d56fe722221c6b0d7e0c2c37e912f7b16a85dfd2d159c426b99e726ddd
-
SHA512
74f3c8d602383bdb86e00c93909aa82b2de682fb44d75275f12f75f6c2fa69757a4747e87d902a46430b8f04f118b0a4c6a9abd82c1326a21e0edfbd07bc3dbd
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4640 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4640 EXCEL.EXE 4640 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PR_A1191-04052021.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4640-2-0x00007FF9A2350000-0x00007FF9A2360000-memory.dmpFilesize
64KB
-
memory/4640-3-0x00007FF9A2350000-0x00007FF9A2360000-memory.dmpFilesize
64KB
-
memory/4640-4-0x00007FF9A2350000-0x00007FF9A2360000-memory.dmpFilesize
64KB
-
memory/4640-5-0x00007FF9C8BF0000-0x00007FF9C9227000-memory.dmpFilesize
6.2MB
-
memory/4640-6-0x00007FF9A2350000-0x00007FF9A2360000-memory.dmpFilesize
64KB