Analysis
-
max time kernel
118s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 18:00
Static task
static1
Behavioral task
behavioral1
Sample
Tax Receipts.xlsx
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Tax Receipts.xlsx
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
Tax Receipts.xlsx
-
Size
369KB
-
MD5
bfcb6ecc43e9babe0ec5c17079353890
-
SHA1
e74276419e06d32ce456a8a44fe801ecd24fbfa4
-
SHA256
fce258aaff67f1ebf4c69bf8f19d48771428a983ef9c2b8811664a40f3d80cbf
-
SHA512
0340ae2f1901daf2298f81d2e56443b368bdbcf702f226543853b311c86f13ce310c804ce8b1135db607d5a9e39613c57aac0d0bc96b4e22a1300464214870d2
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4056 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE 4056 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Tax Receipts.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4056-115-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/4056-116-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/4056-117-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/4056-118-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/4056-119-0x00000220B85D0000-0x00000220B85D2000-memory.dmpFilesize
8KB
-
memory/4056-120-0x00000220B85D0000-0x00000220B85D2000-memory.dmpFilesize
8KB
-
memory/4056-121-0x00000220B85D0000-0x00000220B85D2000-memory.dmpFilesize
8KB
-
memory/4056-127-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB