Analysis
-
max time kernel
126s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 16:24
Behavioral task
behavioral1
Sample
Outstanding-Debt-1840996632-05042021.xlsm
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Outstanding-Debt-1840996632-05042021.xlsm
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
Outstanding-Debt-1840996632-05042021.xlsm
-
Size
114KB
-
MD5
0276be45120eeb640587451db55759cb
-
SHA1
51424cff72ecb039f78d5005a03ec2882a96d7dd
-
SHA256
06c9a8f5da75ebc77f7528ceb2797050ba17cc2c7e36467b0d259d4f48dbbcbf
-
SHA512
588441fa0cc28dc18ff0ebc51f40ecba27012125ccedff3866b75d717e8360c19149ed75f0bf83027088e1789b4228a0f5810c94c60c06ff0d4bbb6bb1da4a2c
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 856 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Outstanding-Debt-1840996632-05042021.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:856