Analysis
-
max time kernel
129s -
max time network
132s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 05:04
Behavioral task
behavioral1
Sample
08f4133865fa8c1f178159bd516a53cdae4e3a980e273ab9cac3d2f8964d6a98.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
08f4133865fa8c1f178159bd516a53cdae4e3a980e273ab9cac3d2f8964d6a98.xlsm
Resource
win10-en-20211208
General
-
Target
08f4133865fa8c1f178159bd516a53cdae4e3a980e273ab9cac3d2f8964d6a98.xlsm
-
Size
83KB
-
MD5
c0870d356e8152ed4f29cf722ad17226
-
SHA1
e34bef3eff98785e44eaacdccd045716716c43f8
-
SHA256
08f4133865fa8c1f178159bd516a53cdae4e3a980e273ab9cac3d2f8964d6a98
-
SHA512
9ae78aa91b5ac6bd57a99841ab020110e90ef3782be77f52118abd302f0811b43aa752b1d9a28f2248f2e819a074a6f74ed20dac5076ee58d2c7d7c6a2303cfb
Malware Config
Extracted
https://zml.laneso.com/packet/AlvJ8OdtSYEeeCQP/
http://ostadsarma.com/wp-admin/JNgASjNC/
http://govtjobresultbd.xyz/sjjz/UIUhOHsLqjOy9/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3116 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 3116 EXCEL.EXE 3116 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE 3116 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\08f4133865fa8c1f178159bd516a53cdae4e3a980e273ab9cac3d2f8964d6a98.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3116-114-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/3116-115-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/3116-116-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/3116-117-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/3116-119-0x000001DB47B10000-0x000001DB47B12000-memory.dmpFilesize
8KB
-
memory/3116-118-0x000001DB47B10000-0x000001DB47B12000-memory.dmpFilesize
8KB
-
memory/3116-120-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/3116-121-0x000001DB47B10000-0x000001DB47B12000-memory.dmpFilesize
8KB