Analysis
-
max time kernel
1151s -
max time network
676s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 03:38
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order NO_16732.xlsx
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order NO_16732.xlsx
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Purchase Order NO_16732.xlsx
-
Size
707KB
-
MD5
163bb3b38532d77a90179771fe6f9c56
-
SHA1
6f54b781306c271e01056b07b3906f992de72d1a
-
SHA256
87ae90b4bcea2975bbd1ff50473088c164a459c54de7b0285180ab66529bd615
-
SHA512
5e1fa9eb521cd15430cdd2ac49d9061a3a9d0d12e56132bfb77f2a049e9ab4d0f68d1432b993af84909b5ae2931cd9eb2bed83242f2d263f2eac50b87ccafe71
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1696 EXCEL.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
EXCEL.EXEpid process 1696 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 25 IoCs
Processes:
EXCEL.EXEpid process 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE 1696 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Purchase Order NO_16732.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1696-114-0x00007FF6B47E0000-0x00007FF6B7D96000-memory.dmpFilesize
53.7MB
-
memory/1696-115-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmpFilesize
64KB
-
memory/1696-116-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmpFilesize
64KB
-
memory/1696-117-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmpFilesize
64KB
-
memory/1696-118-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmpFilesize
64KB
-
memory/1696-119-0x00007FF8C8B00000-0x00007FF8C8B10000-memory.dmpFilesize
64KB
-
memory/1696-122-0x00007FF8E9300000-0x00007FF8EA3EE000-memory.dmpFilesize
16.9MB
-
memory/1696-123-0x000001AC16FC0000-0x000001AC18EB5000-memory.dmpFilesize
31.0MB