a218f6790ee850c45bc013ffa81350ff30770d0d06d1d16e0bde8a093fd63969

Analysis

max time kernel
101s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
06-07-2022 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

decrypted.xlsx
Size

170KB
MD5

68f25039e42b31408e1e22ea9fac7cf7
SHA1

a507fcc5d4d7a1bbea2fd893576043bf9279d11d
SHA256

71e1418e7cf4790fff7f22539f12ccf1a0d9fb9a419e138034ea7a954f4a9a51
SHA512

e9135a676e2c7d5e43896fc8f6b41b5d15ce0940ed60e8de157b4bdd7d8eb09424f43a3cebab8cc21919002558f5ce012589dc61ce3c0e575584bd446a956f2e

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

444 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

444 EXCEL.EXE
444 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE
444	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\decrypted.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-130-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/444-132-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/444-131-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/444-133-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/444-134-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/444-135-0x00007FFA97440000-0x00007FFA97450000-memory.dmp

Filesize
64KB

Download
memory/444-136-0x00007FFA97440000-0x00007FFA97450000-memory.dmp

Filesize
64KB

Download
memory/444-138-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/444-139-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/444-140-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download
memory/444-141-0x00007FFA994D0000-0x00007FFA994E0000-memory.dmp

Filesize
64KB

Download