Analysis
-
max time kernel
101s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 12:16
Static task
static1
Behavioral task
behavioral1
Sample
88160011B.xlsx
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
88160011B.xlsx
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
88160011B.xlsx
-
Size
39KB
-
MD5
9add119c83c891469f6aacf6e1128544
-
SHA1
f87dceb2802e8e10eb36b4a913da50529901ac34
-
SHA256
496f836f4de8ae952cd6749a0d8ada4d53e8095b38032b9e1b526b025ce3081d
-
SHA512
1525620e45e55f5b8798d98694283692e2729a969b4b2d458b136b77199cf2dc0520e34c45e566afbe23b587b0057600680cef8d7df8d1f8b410763ac45e8488
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2900 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\88160011B.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2900-130-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/2900-131-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/2900-132-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/2900-133-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/2900-134-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/2900-135-0x00007FFC8D0F0000-0x00007FFC8D100000-memory.dmpFilesize
64KB
-
memory/2900-136-0x00007FFC8D0F0000-0x00007FFC8D100000-memory.dmpFilesize
64KB
-
memory/2900-138-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/2900-139-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/2900-140-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB
-
memory/2900-141-0x00007FFC8F810000-0x00007FFC8F820000-memory.dmpFilesize
64KB