d3788e69dd125449af3d985de93701c49cef0658bc98e3b449185f86cbee027d

Analysis

max time kernel
101s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2022 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EABE-1892921085.xlsb
Size

233KB
MD5

4f8a3fbbb04355b3671d7bdd0c6b77b3
SHA1

f4475896b8a0e6d6c4d21eb433df2926affccfcc
SHA256

d3788e69dd125449af3d985de93701c49cef0658bc98e3b449185f86cbee027d
SHA512

7b56450eb27a3d7142e72d8a95a4be5a0e5dab8bebce3c4d7727874ac2219e5a2d25835f1943f6d20784d5525eaa83cadacf6ff3708342d42947483156fc083a
SSDEEP

3072:CsRqaz6kqB/EsWcXCJGbtyntvHGiYMnIOwKSIYFUQRLmTDBwszHbcOQafZDK:Csw5nRXCw+DnIdFUKmTDBwsz7c1yDK

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4460 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE
4460	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\EABE-1892921085.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4460-132-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download
memory/4460-133-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download
memory/4460-134-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download
memory/4460-135-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download
memory/4460-136-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download
memory/4460-137-0x00007FFA1FBA0000-0x00007FFA1FBB0000-memory.dmp

Filesize
64KB

Download
memory/4460-138-0x00007FFA1FBA0000-0x00007FFA1FBB0000-memory.dmp

Filesize
64KB

Download
memory/4460-143-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download
memory/4460-142-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download
memory/4460-141-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download
memory/4460-140-0x00007FFA22010000-0x00007FFA22020000-memory.dmp

Filesize
64KB

Download