c78a4663379823e03dbb6aca0b9258d4ff5e7785751d855eb58fbf35650c1b87

Analysis

max time kernel
121s
max time network
149s
platform
windows10_x64
resource
win10v20210408
submitted
10-05-2021 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2513bdc6_by_Libranalysis.xlsm
Size

60KB
MD5

2513bdc618624f67bfdd1a94fd483f3d
SHA1

017ab7785b310dce4a3f29aac1c51e6f4a940564
SHA256

c78a4663379823e03dbb6aca0b9258d4ff5e7785751d855eb58fbf35650c1b87
SHA512

e46fd141d321370e4873f2f91365b0154a53888004486d5434b22acceeab81035af63a36581d25641b208661f2ca3e136213a33472d1f68f1c2f832088a8bf15

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1108 EXCEL.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

EXCEL.EXE

pid process

1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE
1108 EXCEL.EXE
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description pid process target process

PID 1108 wrote to memory of 648 1108 EXCEL.EXE splwow64.exe
PID 1108 wrote to memory of 648 1108 EXCEL.EXE splwow64.exe

pid	process
1108	EXCEL.EXE

pid	process
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE
1108	EXCEL.EXE

description	pid	process	target process
PID 1108 wrote to memory of 648	1108	EXCEL.EXE	splwow64.exe
PID 1108 wrote to memory of 648	1108	EXCEL.EXE	splwow64.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2513bdc6_by_Libranalysis.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:648

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-179-0x0000000000000000-mapping.dmp

Download
memory/1108-114-0x00007FF678380000-0x00007FF67B936000-memory.dmp

Filesize
53.7MB

Download
memory/1108-115-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/1108-116-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/1108-117-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/1108-118-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/1108-121-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/1108-122-0x00007FFAD82C0000-0x00007FFAD93AE000-memory.dmp

Filesize
16.9MB

Download
memory/1108-123-0x0000016B3ED40000-0x0000016B40C35000-memory.dmp

Filesize
31.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads