Analysis
-
max time kernel
1200s -
max time network
946s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
28-07-2021 05:20
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER NO_2807.xlsx
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PURCHASE ORDER NO_2807.xlsx
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
PURCHASE ORDER NO_2807.xlsx
-
Size
672KB
-
MD5
2902877e609d74de1bbdc56c23aabcb1
-
SHA1
f07665cce2f3ac96345aa0d00a0562572eb8e496
-
SHA256
8a80b6705686eaae47aba889cdf519403bb009f0e2c74432b1afad406a12522f
-
SHA512
3b0fbb6e97a516b9d02302f0444d6e53a973281fa3d19c390e5b6db2c3d7ab3773db76f202b0f91ed2cc58100cdc750d98b0c8db2c11eba4029999bbd86d1599
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3224 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
EXCEL.EXEpid process 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE 3224 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER NO_2807.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3224-114-0x00007FF6F0480000-0x00007FF6F3A36000-memory.dmpFilesize
53.7MB
-
memory/3224-115-0x00007FFAC36F0000-0x00007FFAC3700000-memory.dmpFilesize
64KB
-
memory/3224-116-0x00007FFAC36F0000-0x00007FFAC3700000-memory.dmpFilesize
64KB
-
memory/3224-117-0x00007FFAC36F0000-0x00007FFAC3700000-memory.dmpFilesize
64KB
-
memory/3224-118-0x00007FFAC36F0000-0x00007FFAC3700000-memory.dmpFilesize
64KB
-
memory/3224-122-0x00007FFAC36F0000-0x00007FFAC3700000-memory.dmpFilesize
64KB
-
memory/3224-121-0x00007FFAE3C60000-0x00007FFAE4D4E000-memory.dmpFilesize
16.9MB
-
memory/3224-123-0x00007FFAE1CB0000-0x00007FFAE3BA5000-memory.dmpFilesize
31.0MB