Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:08
Behavioral task
behavioral1
Sample
utente_949.xls
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
utente_949.xls
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
utente_949.xls
-
Size
181KB
-
MD5
4b98318e72c8261325f8a694cb8c415c
-
SHA1
8a5b312f966c8103ae252f80be3f440928917aa9
-
SHA256
5529283bad8ab5d6288cd67ed0d17a5ea68323c59702cf4c7b46e6bd1a3dbe7e
-
SHA512
19659c8e5117031392ed8ad37cc99819e30be442d349f3ea4d4ec2ed7ee69771c9f4153e3f6dd5c9c4c049ea9ae8256b8c6ad600da7c5e3134f80fa3d597604d
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 832 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE 832 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\utente_949.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-130-0x00007FF85D210000-0x00007FF85D220000-memory.dmpFilesize
64KB
-
memory/832-131-0x00007FF85D210000-0x00007FF85D220000-memory.dmpFilesize
64KB
-
memory/832-132-0x00007FF85D210000-0x00007FF85D220000-memory.dmpFilesize
64KB
-
memory/832-133-0x00007FF85D210000-0x00007FF85D220000-memory.dmpFilesize
64KB
-
memory/832-134-0x00007FF85D210000-0x00007FF85D220000-memory.dmpFilesize
64KB
-
memory/832-135-0x00007FF85AFF0000-0x00007FF85B000000-memory.dmpFilesize
64KB
-
memory/832-136-0x00007FF85AFF0000-0x00007FF85B000000-memory.dmpFilesize
64KB