Analysis
-
max time kernel
110s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 19:40
Static task
static1
Behavioral task
behavioral1
Sample
product picture.xlsx
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
product picture.xlsx
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
product picture.xlsx
-
Size
629KB
-
MD5
a793904f9e649cdec7b2d27b7f6faf0d
-
SHA1
9a364e1755fbb8ed41ba9c34364e85255ff2d636
-
SHA256
1cfe05628f52cf99f5320c612e340abe35d30f56527d3949677b87716914d68d
-
SHA512
53d38acd0fa81b6a979b5777378453d1a8612591095de78f0763e080a20e283bf9c80aae3fc8956739f5dcede7b0f11d7c587118f6fab6f091fa82d27a431163
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 996 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE 996 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\product picture.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-114-0x00007FF71C6A0000-0x00007FF71FC56000-memory.dmpFilesize
53.7MB
-
memory/996-115-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB
-
memory/996-116-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB
-
memory/996-117-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB
-
memory/996-118-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB
-
memory/996-119-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB
-
memory/996-122-0x00007FF882120000-0x00007FF88320E000-memory.dmpFilesize
16.9MB
-
memory/996-123-0x000001CEE3F70000-0x000001CEE5E65000-memory.dmpFilesize
31.0MB
-
memory/996-271-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB
-
memory/996-272-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB
-
memory/996-273-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB
-
memory/996-274-0x00007FF861870000-0x00007FF861880000-memory.dmpFilesize
64KB