Analysis
-
max time kernel
105s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 18:03
Static task
static1
Behavioral task
behavioral1
Sample
Electronic Funds TT.xlsx
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Electronic Funds TT.xlsx
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Electronic Funds TT.xlsx
-
Size
176KB
-
MD5
338f65dfd7adebb7e42da3ad001e46b3
-
SHA1
234e9f2637df1942d818b4b31aeea109e16e7b4f
-
SHA256
51f2a6bc3924202ea499d130c6439d3f372438884731641622101690733a35e9
-
SHA512
741b810efbf341f781fe8d0be65b2d1f6e4273897359f1af59a2467704089f0522794fb4af5d074b03fe00f33b80bf7fd8a590c01246d2c6977e48719c3568b3
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 5056 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE 5056 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Electronic Funds TT.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5056-130-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB
-
memory/5056-131-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB
-
memory/5056-132-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB
-
memory/5056-133-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB
-
memory/5056-134-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB
-
memory/5056-135-0x00007FFD1E400000-0x00007FFD1E410000-memory.dmpFilesize
64KB
-
memory/5056-136-0x00007FFD1E400000-0x00007FFD1E410000-memory.dmpFilesize
64KB
-
memory/5056-138-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB
-
memory/5056-139-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB
-
memory/5056-140-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB
-
memory/5056-141-0x00007FFD20A90000-0x00007FFD20AA0000-memory.dmpFilesize
64KB