Analysis
-
max time kernel
114s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
12-07-2021 12:21
Static task
static1
Behavioral task
behavioral1
Sample
87482.xlsx
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
87482.xlsx
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
87482.xlsx
-
Size
1.1MB
-
MD5
691c1f98e15a9adfad552d13a383900c
-
SHA1
b8b48ea114731bbe1f93074c5e57a7dc877aab36
-
SHA256
7fdb072b859acf022effc3f1033b96b2c7f90faaecac8352c3e39db31c53cdaf
-
SHA512
3ca064d10d8884014c4e56ef542a93afb8a0f1904323a26ac1f006007e74a5ff2414ace9df1bd8025113e87a3872a53f6dd22a893b1787cb666d28b255891fe5
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 804 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE 804 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\87482.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:804