Analysis
-
max time kernel
129s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
04/11/2022, 00:45
Behavioral task
behavioral1
Sample
65076ccc8d59431f8324108859b5f1a92fcab3766c45319e035521eeea529759.xls
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
65076ccc8d59431f8324108859b5f1a92fcab3766c45319e035521eeea529759.xls
Resource
win10-20220901-en
General
-
Target
65076ccc8d59431f8324108859b5f1a92fcab3766c45319e035521eeea529759.xls
-
Size
217KB
-
MD5
82cca649db0024a2f6d8705c5a205720
-
SHA1
a17df70453f3eac23a49da728410e9778488552b
-
SHA256
65076ccc8d59431f8324108859b5f1a92fcab3766c45319e035521eeea529759
-
SHA512
712980710d1bce91fdd2d4dc5bb95df543317fa0a90e3ebb2286c2477528b4ee2f5c5c56cf80663e18abbdba76633e36f88c5cc00bf50fb85cf8fc1dd4e4a76a
-
SSDEEP
6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dglyY+TAQXTHGUMEyP5p6f5jQm8:JbGUMVWlb8
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3932 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE 3932 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\65076ccc8d59431f8324108859b5f1a92fcab3766c45319e035521eeea529759.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3932