Analysis
-
max time kernel
103s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
04-05-2021 16:35
Behavioral task
behavioral1
Sample
Outstanding-Debt-2132043062-05042021.xlsm
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Outstanding-Debt-2132043062-05042021.xlsm
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
Outstanding-Debt-2132043062-05042021.xlsm
-
Size
114KB
-
MD5
075a0d3b6b0ccfa09d169ea23cf3fd90
-
SHA1
1485dac9d796c7892c369279e794ed2c18866403
-
SHA256
53eec78c7ea9a664974ec50b91f18a3c827be87a0b428c01ec3102a9ce9121d0
-
SHA512
b8c6479345ce2bb250867dbbc589b2f0617f0c77f6366eb23aa09224830d63e884fa6c6d9154f5eeb40a4cbf56bde3f0bf566fe10db801e7db3fed3388b56d83
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3944 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Outstanding-Debt-2132043062-05042021.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3944