Overview
overview
10Static
static
8Fattura_01137434.xlsm
windows7_x64
1Fattura_01137434.xlsm
windows10_x64
1Fattura_01438445.xlsm
windows7_x64
1Fattura_01438445.xlsm
windows10_x64
1Fattura_01634446.xlsm
windows7_x64
1Fattura_01634446.xlsm
windows10_x64
1IMG_056_107_0282.exe
windows7_x64
10IMG_056_107_0282.exe
windows10_x64
10IMG_056_107_0282.xlsx
windows7_x64
8IMG_056_107_0282.xlsx
windows10_x64
1IMG_5018_330_92.exe
windows7_x64
10IMG_5018_330_92.exe
windows10_x64
10IMG_5018_330_92.xlsx
windows7_x64
8IMG_5018_330_92.xlsx
windows10_x64
1PI.exe
windows7_x64
10PI.exe
windows10_x64
10cks.exe
windows7_x64
10cks.exe
windows10_x64
10Scan_018819.exe
windows7_x64
10Scan_018819.exe
windows10_x64
10slot Charges.exe
windows7_x64
10slot Charges.exe
windows10_x64
10Analysis
-
max time kernel
103s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 21:57
Static task
static1
Behavioral task
behavioral1
Sample
Fattura_01137434.xlsm
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Fattura_01137434.xlsm
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Fattura_01438445.xlsm
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Fattura_01438445.xlsm
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Fattura_01634446.xlsm
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Fattura_01634446.xlsm
Resource
win10v20210410
Behavioral task
behavioral7
Sample
IMG_056_107_0282.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
IMG_056_107_0282.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
IMG_056_107_0282.xlsx
Resource
win7v20210410
Behavioral task
behavioral10
Sample
IMG_056_107_0282.xlsx
Resource
win10v20210408
Behavioral task
behavioral11
Sample
IMG_5018_330_92.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
IMG_5018_330_92.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
IMG_5018_330_92.xlsx
Resource
win7v20210410
Behavioral task
behavioral14
Sample
IMG_5018_330_92.xlsx
Resource
win10v20210408
Behavioral task
behavioral15
Sample
PI.exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
PI.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
cks.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
cks.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Scan_018819.exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Scan_018819.exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
slot Charges.exe
Resource
win7v20210410
General
-
Target
Fattura_01137434.xlsm
-
Size
45KB
-
MD5
589908c69f247ea72c95f5ddb73cc754
-
SHA1
fd09c95120b2e9a9cbfaabc020692ef6033de489
-
SHA256
c29e9174d9c04bfbfdea49fe3804230bec0d893a1e6c6efa8fd5a6f9df59aaec
-
SHA512
f04a7612eed879b56a3638aaf8aa093143f336e77f6641a6d66ba7618f67dcf13970d094079030564bc86dc706e5deb8d5f2466ea2e9320ccd3ae22b9c034291
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3932 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Fattura_01137434.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3932