2f12b09b257e88b05b03eba2d3ec27d74ac6ab1144b7373058f1e87b3555b1f8

Resubmissions

27-10-2021 20:46

211027-zks8ksgdh6 10

27-10-2021 10:26

211027-mghw8abfh9 8

Analysis

max time kernel
123s
max time network
135s
platform
windows10_x64
resource
win10-en-20211014
submitted
27-10-2021 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase_Order 8328.xls
Size

79KB
MD5

18dd59051822628a3ecbbdc902888ca8
SHA1

df1745ee2b92e041128bf83242df6d6d32858231
SHA256

2f12b09b257e88b05b03eba2d3ec27d74ac6ab1144b7373058f1e87b3555b1f8
SHA512

5364687cafff4045f08e4f45eb9c12c2602fd0f9d99e46ce6fd68b2b8798d31047f1a285605872555aecc71a6167e0a8f3b7f51878d145a5b5ace47bacd573ed

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2680 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE
2680	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Purchase_Order 8328.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-118-0x00007FFF60480000-0x00007FFF60490000-memory.dmp

Filesize
64KB

Download
memory/2680-119-0x00007FFF60480000-0x00007FFF60490000-memory.dmp

Filesize
64KB

Download
memory/2680-120-0x00007FFF60480000-0x00007FFF60490000-memory.dmp

Filesize
64KB

Download
memory/2680-121-0x00007FFF60480000-0x00007FFF60490000-memory.dmp

Filesize
64KB

Download
memory/2680-122-0x00007FFF60480000-0x00007FFF60490000-memory.dmp

Filesize
64KB

Download
memory/2680-124-0x00000257E3CE0000-0x00000257E3CE2000-memory.dmp

Filesize
8KB

Download
memory/2680-123-0x00000257E3CE0000-0x00000257E3CE2000-memory.dmp

Filesize
8KB

Download
memory/2680-125-0x00000257E3CE0000-0x00000257E3CE2000-memory.dmp

Filesize
8KB

Download
memory/2680-131-0x00007FFF5CB40000-0x00007FFF5CB50000-memory.dmp

Filesize
64KB

Download
memory/2680-132-0x00007FFF5CB40000-0x00007FFF5CB50000-memory.dmp

Filesize
64KB

Download