Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-01-2022 13:12
Behavioral task
behavioral1
Sample
2f81803167aa54a2145538e204189722bb88af57a776b9ce3e46b3259b16945a.xlsm
Resource
win10-en-20211208
General
-
Target
2f81803167aa54a2145538e204189722bb88af57a776b9ce3e46b3259b16945a.xlsm
-
Size
99KB
-
MD5
a53e1dc1a923e50825c1486bb7604aa0
-
SHA1
7be2ced61d359130d67c39f25a07965e2ecb1da0
-
SHA256
2f81803167aa54a2145538e204189722bb88af57a776b9ce3e46b3259b16945a
-
SHA512
29878c188ed20531932a8c1b57e251342a9c4fdd71d9aabdc0642a853bb6bce1d078d6a3d07175170194274f5ae6df1ec22f82850687e69b4e53865c3e8ec8c0
Malware Config
Extracted
http://shop.lambolero.com/iiwkjgp/eu7rH6/
http://api.task-lite.com/-/EYe3DEfcw7LCaU6T/
https://celhocortofilmfestival.stream/css/oQSBr44obE/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2756 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 2756 EXCEL.EXE 2756 EXCEL.EXE 2756 EXCEL.EXE 2756 EXCEL.EXE 2756 EXCEL.EXE 2756 EXCEL.EXE 2756 EXCEL.EXE 2756 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2f81803167aa54a2145538e204189722bb88af57a776b9ce3e46b3259b16945a.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2756-115-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB
-
memory/2756-116-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB
-
memory/2756-117-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB
-
memory/2756-118-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB
-
memory/2756-119-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB
-
memory/2756-128-0x00007FFB2DC70000-0x00007FFB2DC80000-memory.dmpFilesize
64KB
-
memory/2756-129-0x00007FFB2DC70000-0x00007FFB2DC80000-memory.dmpFilesize
64KB
-
memory/2756-290-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB
-
memory/2756-291-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB
-
memory/2756-292-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB
-
memory/2756-293-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmpFilesize
64KB