Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:07
Behavioral task
behavioral1
Sample
agenzia_entrate_1177.xls
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
agenzia_entrate_1177.xls
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
agenzia_entrate_1177.xls
-
Size
187KB
-
MD5
3de9bab8d820044a03c14bd05a951bcd
-
SHA1
6090005ebb8174e89cf94cbee7552a42edb7b769
-
SHA256
6f60bffdaf12ad493883c292fbe55a7f1619aa9d8900bdbfcc9f36d20c21c456
-
SHA512
a1aac73e9c8a194ef2446432b63b29c88e4d9e36a2a268fb1e5391381aa3d5a2d21e54bacabbd7c95219a4c8c94d67a6f2852c506a94b1831fc50ac5dc7ea8fb
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4476 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
EXCEL.EXEpid process 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE 4476 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\agenzia_entrate_1177.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4476-130-0x00007FFC58FD0000-0x00007FFC58FE0000-memory.dmpFilesize
64KB
-
memory/4476-131-0x00007FFC58FD0000-0x00007FFC58FE0000-memory.dmpFilesize
64KB
-
memory/4476-132-0x00007FFC58FD0000-0x00007FFC58FE0000-memory.dmpFilesize
64KB
-
memory/4476-133-0x00007FFC58FD0000-0x00007FFC58FE0000-memory.dmpFilesize
64KB
-
memory/4476-134-0x00007FFC58FD0000-0x00007FFC58FE0000-memory.dmpFilesize
64KB
-
memory/4476-135-0x00007FFC56820000-0x00007FFC56830000-memory.dmpFilesize
64KB
-
memory/4476-136-0x00007FFC56820000-0x00007FFC56830000-memory.dmpFilesize
64KB