2f12b09b257e88b05b03eba2d3ec27d74ac6ab1144b7373058f1e87b3555b1f8

Resubmissions

27-10-2021 20:46

211027-zks8ksgdh6 10

27-10-2021 10:26

211027-mghw8abfh9 8

Analysis

max time kernel
83s
max time network
123s
submitted
01-01-1970 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase_Order 8328.xls
Size

79KB
MD5

18dd59051822628a3ecbbdc902888ca8
SHA1

df1745ee2b92e041128bf83242df6d6d32858231
SHA256

2f12b09b257e88b05b03eba2d3ec27d74ac6ab1144b7373058f1e87b3555b1f8
SHA512

5364687cafff4045f08e4f45eb9c12c2602fd0f9d99e46ce6fd68b2b8798d31047f1a285605872555aecc71a6167e0a8f3b7f51878d145a5b5ace47bacd573ed

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2092 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE
2092	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Purchase_Order 8328.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-115-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmp

Filesize
64KB

Download
memory/2092-116-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmp

Filesize
64KB

Download
memory/2092-117-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmp

Filesize
64KB

Download
memory/2092-118-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmp

Filesize
64KB

Download
memory/2092-119-0x0000020657120000-0x0000020657122000-memory.dmp

Filesize
8KB

Download
memory/2092-120-0x0000020657120000-0x0000020657122000-memory.dmp

Filesize
8KB

Download
memory/2092-121-0x0000020657120000-0x0000020657122000-memory.dmp

Filesize
8KB

Download
memory/2092-127-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmp

Filesize
64KB

Download