3e49784f4bd41328125657df969f475ce1ee7abc3cbd4d63a4d0d7357e423d10

Analysis

max time kernel
106s
max time network
130s
platform
windows10_x64
resource
win10-en-20211014
submitted
19-10-2021 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Order nr. 763ES.xlsx
Size

343KB
MD5

eaca11f07cac788acad6a132e11dc812
SHA1

c2b84d6bef526eea74cf6ff072faab8240a294dd
SHA256

3e49784f4bd41328125657df969f475ce1ee7abc3cbd4d63a4d0d7357e423d10
SHA512

5aee5dde91ba1c887945d4621b0eccf110ff966cf51649200632734d4945d6ee726331900d9caf0aca971bca96d7ce81e3de55f5132d6ad568e6e7d3c0b0cfd1

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2732 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE
2732	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\New Order nr. 763ES.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-115-0x00007FFE41220000-0x00007FFE41230000-memory.dmp

Filesize
64KB

Download
memory/2732-116-0x00007FFE41220000-0x00007FFE41230000-memory.dmp

Filesize
64KB

Download
memory/2732-117-0x00007FFE41220000-0x00007FFE41230000-memory.dmp

Filesize
64KB

Download
memory/2732-118-0x00007FFE41220000-0x00007FFE41230000-memory.dmp

Filesize
64KB

Download
memory/2732-119-0x00007FFE41220000-0x00007FFE41230000-memory.dmp

Filesize
64KB

Download
memory/2732-121-0x000001FE827D0000-0x000001FE827D2000-memory.dmp

Filesize
8KB

Download
memory/2732-120-0x000001FE827D0000-0x000001FE827D2000-memory.dmp

Filesize
8KB

Download
memory/2732-122-0x000001FE827D0000-0x000001FE827D2000-memory.dmp

Filesize
8KB

Download
memory/2732-128-0x00007FFE3DFA0000-0x00007FFE3DFB0000-memory.dmp

Filesize
64KB

Download
memory/2732-129-0x00007FFE3DFA0000-0x00007FFE3DFB0000-memory.dmp

Filesize
64KB

Download