Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2022 19:10
Behavioral task
behavioral1
Sample
Payment Advice.xls
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Payment Advice.xls
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
Payment Advice.xls
-
Size
124KB
-
MD5
873c90af6836b2ad3cce748e99d1b0bd
-
SHA1
266f7f7ac7890227852a996d5f71bf09483616df
-
SHA256
9465c35c652271b12b696f88d353149641b74c354d955753e10ee14424e84f88
-
SHA512
e52eeebb1997b795331fac921dee3e831bd1cc44a73921e2bc5454bb56e3b68f7313aa90fc8bf8519e0afc1fff68ae5850dcfa8e2d2bdc404dd5e9774878d071
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots EXCEL.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff EXCEL.EXE -
NTFS ADS 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{B6B66430-E3DD-439E-9D25-3D9809675F6E}\sShlx.txt:Zone.Identifier EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1524 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE 1524 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment Advice.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1524-132-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmpFilesize
64KB
-
memory/1524-134-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmpFilesize
64KB
-
memory/1524-133-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmpFilesize
64KB
-
memory/1524-135-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmpFilesize
64KB
-
memory/1524-136-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmpFilesize
64KB
-
memory/1524-137-0x00007FFA8AF20000-0x00007FFA8AF30000-memory.dmpFilesize
64KB
-
memory/1524-138-0x00007FFA8AF20000-0x00007FFA8AF30000-memory.dmpFilesize
64KB