b224f2409381b02e0f465d688fba51a84efc05092c484fc5521b6b2ac8698aa9

Analysis

max time kernel
146s
max time network
162s
platform
windows10_x64
resource
win10-en-20211014
submitted
03-11-2021 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TT_0032411983221 advice.xlsx
Size

185KB
MD5

8601e9fbd0710b734aaa95ba56ebf397
SHA1

d5fefeba0606f92a7223bbe51091132404670daa
SHA256

b224f2409381b02e0f465d688fba51a84efc05092c484fc5521b6b2ac8698aa9
SHA512

2f85167f109a1cbe77dcbe5bebbcd00f83abc72f34f491657f3e25319aaed07ee68e529287e500ca6220fb88f2b171f4b7cb0040de34c488d3d8b72c70abc95d

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4012 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE
4012	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TT_0032411983221 advice.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4012-118-0x00007FF817560000-0x00007FF817570000-memory.dmp

Filesize
64KB

Download
memory/4012-119-0x00007FF817560000-0x00007FF817570000-memory.dmp

Filesize
64KB

Download
memory/4012-120-0x00007FF817560000-0x00007FF817570000-memory.dmp

Filesize
64KB

Download
memory/4012-121-0x00007FF817560000-0x00007FF817570000-memory.dmp

Filesize
64KB

Download
memory/4012-122-0x00007FF817560000-0x00007FF817570000-memory.dmp

Filesize
64KB

Download
memory/4012-123-0x0000016CFE740000-0x0000016CFE742000-memory.dmp

Filesize
8KB

Download
memory/4012-124-0x0000016CFE740000-0x0000016CFE742000-memory.dmp

Filesize
8KB

Download
memory/4012-125-0x0000016CFE740000-0x0000016CFE742000-memory.dmp

Filesize
8KB

Download