Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-01-2022 21:02
Behavioral task
behavioral1
Sample
1db259b0063d26f9af684e7246d336250e289514a4e900eab1337ee9981a866b.xls
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
1db259b0063d26f9af684e7246d336250e289514a4e900eab1337ee9981a866b.xls
Resource
win10-en-20211208
General
-
Target
1db259b0063d26f9af684e7246d336250e289514a4e900eab1337ee9981a866b.xls
-
Size
113KB
-
MD5
1db77f0d16e44a513d941c17e895dd02
-
SHA1
a8451288d8309179bb580d9d6949ee23f7a24eaf
-
SHA256
1db259b0063d26f9af684e7246d336250e289514a4e900eab1337ee9981a866b
-
SHA512
bf0df083a63711cfddb999548afa1729e0fa4a637f1d35fe1eb282c46eed9fee55ff740e593c9893f241ad28975f5b032f8fbd4a72a5d9000115c135ff0a8719
Malware Config
Extracted
http://gaidov.bg/wp-includes/Ug/
http://studiokrishnaproduction.com/wp-includes/3mJ/
http://goodmarketinggroup.com/live_site/Y9cEk9QNlDUeg/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2360 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1db259b0063d26f9af684e7246d336250e289514a4e900eab1337ee9981a866b.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2360-118-0x00007FFCB13B0000-0x00007FFCB13C0000-memory.dmpFilesize
64KB
-
memory/2360-119-0x00007FFCB13B0000-0x00007FFCB13C0000-memory.dmpFilesize
64KB
-
memory/2360-120-0x00007FFCB13B0000-0x00007FFCB13C0000-memory.dmpFilesize
64KB
-
memory/2360-121-0x00007FFCB13B0000-0x00007FFCB13C0000-memory.dmpFilesize
64KB
-
memory/2360-122-0x00007FFCB13B0000-0x00007FFCB13C0000-memory.dmpFilesize
64KB
-
memory/2360-124-0x000002628C2A0000-0x000002628C2A2000-memory.dmpFilesize
8KB
-
memory/2360-123-0x000002628C2A0000-0x000002628C2A2000-memory.dmpFilesize
8KB
-
memory/2360-125-0x000002628C2A0000-0x000002628C2A2000-memory.dmpFilesize
8KB