Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-01-2022 21:02
Behavioral task
behavioral1
Sample
80f732153350e276a2b676506c38904e02387501bbd7946340ee90858bcc5f79.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
80f732153350e276a2b676506c38904e02387501bbd7946340ee90858bcc5f79.xlsm
Resource
win10-en-20211208
General
-
Target
80f732153350e276a2b676506c38904e02387501bbd7946340ee90858bcc5f79.xlsm
-
Size
82KB
-
MD5
cddd70be02fe3a31ec6a738deb05c6c1
-
SHA1
21ad389c6dd1ea3b3bd7b4080f06a8d2c1da5b8c
-
SHA256
80f732153350e276a2b676506c38904e02387501bbd7946340ee90858bcc5f79
-
SHA512
6354c04afccb34262f4a816e99ee1c59604041372f1083d63ab15685607a551ead68b8663f175d3ff487779a71edf85b71dcff4dcd5810a05be651d8e3a5bc37
Malware Config
Extracted
http://insertcatherreview.xyz/wp-includes/UUlQtC51SL8IzBT/
http://bbc-us.com/wp-admin/48r6tiF1qTMqrAO/
http://vulkanvegasbonus.jeunete.com/igepuuuy/EPylXD8BuTAslj/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3532 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3532 EXCEL.EXE 3532 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3532 EXCEL.EXE 3532 EXCEL.EXE 3532 EXCEL.EXE 3532 EXCEL.EXE 3532 EXCEL.EXE 3532 EXCEL.EXE 3532 EXCEL.EXE 3532 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\80f732153350e276a2b676506c38904e02387501bbd7946340ee90858bcc5f79.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3532