Analysis
-
max time kernel
103s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 09:10
Static task
static1
Behavioral task
behavioral1
Sample
KOC BQ-2022-PROC-SI-68.xlsx
Resource
win7-20220718-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
KOC BQ-2022-PROC-SI-68.xlsx
Resource
win10v2004-20220721-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
KOC BQ-2022-PROC-SI-68.xlsx
-
Size
110KB
-
MD5
21889c7c54d86bd8b3e376a8f23e068c
-
SHA1
433870de72541bf95aa33bdd8d03f7039a30e853
-
SHA256
cc5b8184b5f785130a42a53b8600a5d12721f49ee6949d93e3a3722f98604135
-
SHA512
9fc8f6f489a9b13e2fef8a52927d582e5088313a2d1ea35097ab40fea68b949c337bb26f08fac97b981896e7e45c72dc4fbf06d9d9b046c754a5c9a5d2551df9
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4944 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\KOC BQ-2022-PROC-SI-68.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4944-130-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB
-
memory/4944-132-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB
-
memory/4944-131-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB
-
memory/4944-133-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB
-
memory/4944-134-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB
-
memory/4944-135-0x00007FFAEE450000-0x00007FFAEE460000-memory.dmpFilesize
64KB
-
memory/4944-136-0x00007FFAEE450000-0x00007FFAEE460000-memory.dmpFilesize
64KB
-
memory/4944-138-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB
-
memory/4944-139-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB
-
memory/4944-140-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB
-
memory/4944-141-0x00007FFAF05B0000-0x00007FFAF05C0000-memory.dmpFilesize
64KB