dc081e39532355a4d1c586b54f8595ceb976b95da8f7897b7a5418e69637a1c1

Analysis

max time kernel
115s
max time network
148s
platform
windows10_x64
resource
win10-en-20210920
submitted
14-10-2021 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase_Order 8897.xls
Size

82KB
MD5

780fb232fdfb63a16edc75c266815141
SHA1

7434fcd90c6556f481b76834becf6ed3877afec9
SHA256

dc081e39532355a4d1c586b54f8595ceb976b95da8f7897b7a5418e69637a1c1
SHA512

05bfc6e05bd3e34b97bcd483811266ac40e9466eca8ba2bde7e09b499a17e8fceca963458e4c584d410d91003e667a0e75c5502cdf2cdfdac3378b00e97e14e0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2396 EXCEL.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

EXCEL.EXE

pid	process
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Purchase_Order 8897.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-115-0x00007FF978D00000-0x00007FF978D10000-memory.dmp

Filesize
64KB

Download
memory/2396-116-0x00007FF978D00000-0x00007FF978D10000-memory.dmp

Filesize
64KB

Download
memory/2396-117-0x00007FF978D00000-0x00007FF978D10000-memory.dmp

Filesize
64KB

Download
memory/2396-118-0x00007FF978D00000-0x00007FF978D10000-memory.dmp

Filesize
64KB

Download
memory/2396-120-0x000001AC12310000-0x000001AC12312000-memory.dmp

Filesize
8KB

Download
memory/2396-119-0x000001AC12310000-0x000001AC12312000-memory.dmp

Filesize
8KB

Download
memory/2396-121-0x00007FF978D00000-0x00007FF978D10000-memory.dmp

Filesize
64KB

Download
memory/2396-122-0x000001AC12310000-0x000001AC12312000-memory.dmp

Filesize
8KB

Download