Behavioral Report

Analysis

max time kernel
150s
max time network
132s
platform
windows10_x64
resource
win10v20210408
submitted
12-10-2021 06:52

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

DHLAWB 191021.xlsx
Size

337KB
MD5

2a2774f89f6ac878975ef5227cc8a92b
SHA1

bfbfd645fed06b7598bfe1f583d0ba04ad943b29
SHA256

54167fce5b8273b4a21f9da96c32113ebe3e5831f51aebad3ae1e97d5165f263
SHA512

58faad098728b89d6e99ee6e240846b04a35047e317791a47905cd2a6117a487e9ae9a6ab6d33d1405c6be4e7cdc71b18c512929c92ed3910b8554ffe13e929d

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

904 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE
904	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\DHLAWB 191021.xlsx"

Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx

PID:904

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Query Registry

T1012

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/904-114-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/904-115-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/904-116-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/904-117-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/904-118-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmp

Filesize
64KB

Download
memory/904-119-0x000002563FE10000-0x000002563FE12000-memory.dmp

Filesize
8KB

Download
memory/904-120-0x000002563FE10000-0x000002563FE12000-memory.dmp

Filesize
8KB

Download
memory/904-121-0x000002563FE10000-0x000002563FE12000-memory.dmp

Filesize
8KB

Download
memory/904-127-0x00007FFAB4520000-0x00007FFAB4530000-memory.dmp

Filesize
64KB

Download
memory/904-128-0x00007FFAB4520000-0x00007FFAB4530000-memory.dmp

Filesize
64KB

Download