Analysis
-
max time kernel
108s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21/06/2022, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
TST - Statement of Accounts(S).xlsx
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TST - Statement of Accounts(S).xlsx
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
TST - Statement of Accounts(S).xlsx
-
Size
71KB
-
MD5
e8ba0382721cd0b5e3f9b8674f1b80a4
-
SHA1
e5466836650b44250ca3097d67cb9269b34034f0
-
SHA256
e98f622a7d9eed1611ec02e09445aff30113b5b3d3c702d90354efd60cc6fcd4
-
SHA512
afe0696b6e5d1bba24c5f3722112225c90ebd82f31409e8f74797efe7d8bf17f2af49dd7d0edcd604cb21c72dd4a5a87fee88fe427000de71b9ac1764e0965dc
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4952 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE 4952 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TST - Statement of Accounts(S).xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4952