Analysis
-
max time kernel
136s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-01-2022 13:52
Behavioral task
behavioral1
Sample
3a8060f115fb2d0a46952181010c96593442b87eef2f5c0b17f8543a05a10b3c.xlsm
Resource
win10-en-20211208
General
-
Target
3a8060f115fb2d0a46952181010c96593442b87eef2f5c0b17f8543a05a10b3c.xlsm
-
Size
99KB
-
MD5
345090358f0ba9a48ee62a15c6d453cd
-
SHA1
f3da72e501314a09034c46992d849c112ba39685
-
SHA256
3a8060f115fb2d0a46952181010c96593442b87eef2f5c0b17f8543a05a10b3c
-
SHA512
98568c1ca92ab008aa46d9dc8c65cf60c5de165a79382593fb3787c07a0176be5c7a35b1940563b3b9f5458e3c6a002baa5502a6569afe7a2fcde452f6c93756
Malware Config
Extracted
http://shop.lambolero.com/iiwkjgp/eu7rH6/
http://api.task-lite.com/-/EYe3DEfcw7LCaU6T/
https://celhocortofilmfestival.stream/css/oQSBr44obE/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2644 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 2644 EXCEL.EXE 2644 EXCEL.EXE 2644 EXCEL.EXE 2644 EXCEL.EXE 2644 EXCEL.EXE 2644 EXCEL.EXE 2644 EXCEL.EXE 2644 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3a8060f115fb2d0a46952181010c96593442b87eef2f5c0b17f8543a05a10b3c.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2644-115-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB
-
memory/2644-116-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB
-
memory/2644-117-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB
-
memory/2644-118-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB
-
memory/2644-119-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB
-
memory/2644-128-0x00007FF937180000-0x00007FF937190000-memory.dmpFilesize
64KB
-
memory/2644-129-0x00007FF937180000-0x00007FF937190000-memory.dmpFilesize
64KB
-
memory/2644-290-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB
-
memory/2644-291-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB
-
memory/2644-292-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB
-
memory/2644-293-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmpFilesize
64KB