Analysis
-
max time kernel
151s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 10:01
Static task
static1
Behavioral task
behavioral1
Sample
Offene RGn - Oel Hauser.xlsx
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Offene RGn - Oel Hauser.xlsx
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
Offene RGn - Oel Hauser.xlsx
-
Size
10KB
-
MD5
c29dad6d6ef1763b6aead798840c2b88
-
SHA1
96b4b8fe7b658914282467848199e3b96586213f
-
SHA256
2be7fa00b4fc0196a74f449af09d056fb69fb24053bbaaa23f9dbe69df6cfd02
-
SHA512
0a5153f7fed4fe199b84d5dec04aac311eb283d49d71067feb69b6e4fd4d14a2a04665ae92d635a6636b4f01d47b5edad743bf5b20a2e54e401e378043ef23ac
-
SSDEEP
192:wc8mVrb3UwUlAJ6+T33WA5wYK8I+xuLxH7MuOLe:wc313FUlAJPT3rOLxHULe
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4692 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE 4692 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Offene RGn - Oel Hauser.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4692