Analysis
-
max time kernel
100s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2022, 04:16
Static task
static1
Behavioral task
behavioral1
Sample
07bd32261f09f7298cf48800e792eb6237e2058215e97402626ceabf77ac723b.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
07bd32261f09f7298cf48800e792eb6237e2058215e97402626ceabf77ac723b.xls
Resource
win10v2004-20220812-en
General
-
Target
07bd32261f09f7298cf48800e792eb6237e2058215e97402626ceabf77ac723b.xls
-
Size
17KB
-
MD5
0fb843ac8ec275a50c39376abe1ec1b7
-
SHA1
a77c7f508e74700ebaa6250a5c911c292e0f9dbc
-
SHA256
07bd32261f09f7298cf48800e792eb6237e2058215e97402626ceabf77ac723b
-
SHA512
4ba2fe5613f135177a1e4ca166b16e7542e7ffdb759d8b22eec70ce3b72cf7e6d6ceeb9af50fdff7744980cb9efc16f1ea01308de645f6ac0d1ce2e0ce1c29dc
-
SSDEEP
96:OhwsHFXD7Pn7Hr5ctErBmI2cUGZX2LkSpGg8pw2S06rs3kvvQoBczT6EjMoN7wAf:OhwONP7LSurnZZX218Es3kvvQFaCpNSk
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2868 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE 2868 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\07bd32261f09f7298cf48800e792eb6237e2058215e97402626ceabf77ac723b.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2868