Analysis
-
max time kernel
200s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 03:50
Static task
static1
Behavioral task
behavioral1
Sample
SWIFTGLV501756103.xlsm
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SWIFTGLV501756103.xlsm
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
SWIFTGLV501756103.xlsm
-
Size
399KB
-
MD5
1601f9f647a94e8acadd600026087903
-
SHA1
67283cdd28c0d8e6fd1b9a65447a936d77874e3a
-
SHA256
e1dbe3338367397078a2e48770e98581226a9658c8812136725368a0c9ed53cd
-
SHA512
3a429f8e72df13a8316c3f104a82634f0f83dc3da438a5d3202cd4d3b2012d678b64d0f76d175fbcfcc04afab995006aaa82dc276c0386a3745c5ff809afe9cc
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4520 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SWIFTGLV501756103.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4520-130-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/4520-132-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/4520-131-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/4520-133-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/4520-134-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/4520-135-0x00007FFC8D0F0000-0x00007FFC8D100000-memory.dmpFilesize
64KB
-
memory/4520-136-0x00007FFC8D0F0000-0x00007FFC8D100000-memory.dmpFilesize
64KB
-
memory/4520-137-0x00000158F9FB2000-0x00000158F9FB4000-memory.dmpFilesize
8KB