Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16/09/2022, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
e5ce23dea9d75588606d9959679c304cd0585b0cce7b11377b99611d04b780f2.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e5ce23dea9d75588606d9959679c304cd0585b0cce7b11377b99611d04b780f2.xls
Resource
win10v2004-20220812-en
General
-
Target
e5ce23dea9d75588606d9959679c304cd0585b0cce7b11377b99611d04b780f2.xls
-
Size
5KB
-
MD5
c83f6125c0afcd6fe83475ed1eb4c66e
-
SHA1
9c904cb5839589256ab381632532985bffc671f7
-
SHA256
e5ce23dea9d75588606d9959679c304cd0585b0cce7b11377b99611d04b780f2
-
SHA512
d204b2f9a776b0c3f590662a7ffefb4b2668afb86def9dad9644ea204f75c3b69627fc5dbff87ee13b0d611224f8c8cb775c9e927f5f9c7410e2a5fcfe6e6a17
-
SSDEEP
96:2gZupt8/0t6nukDGUT/Stwp8MT6W+H1FmbD:tZ8t8/U6/DGUDSSCVW+H1FgD
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4984 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE 4984 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e5ce23dea9d75588606d9959679c304cd0585b0cce7b11377b99611d04b780f2.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4984