Analysis
-
max time kernel
147s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-07-2021 20:31
Static task
static1
Behavioral task
behavioral1
Sample
4ccde33da5102adc2990f49331e84b56.xls
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4ccde33da5102adc2990f49331e84b56.xls
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
4ccde33da5102adc2990f49331e84b56.xls
-
Size
660KB
-
MD5
4ccde33da5102adc2990f49331e84b56
-
SHA1
e7332faff1e87f6e0a939472b729b4fa23b08df1
-
SHA256
af931881445f375b740f42f182c797e8267c576e36f3093b10a935744154df60
-
SHA512
9ba530cc363d3aaacea9df88c63590389b3d0cb850945d7befa90e4d489db264df1ce447085f6400b0b90fc5282ce5782c387fe6d8a7bbbee735483888d94d22
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4048 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE 4048 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4ccde33da5102adc2990f49331e84b56.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4048