Analysis
-
max time kernel
129s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
04-11-2022 12:48
Behavioral task
behavioral1
Sample
93733f92c8074a4bc30aeb5338403738c0eae7a15f32e9fb9e26acb0973ec82e.xls
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
93733f92c8074a4bc30aeb5338403738c0eae7a15f32e9fb9e26acb0973ec82e.xls
Resource
win10-20220901-en
General
-
Target
93733f92c8074a4bc30aeb5338403738c0eae7a15f32e9fb9e26acb0973ec82e.xls
-
Size
217KB
-
MD5
af31b81a68d04657a942c9b90df21bd7
-
SHA1
dcaaa435d2a002418e9b067bf797a406e159edd3
-
SHA256
93733f92c8074a4bc30aeb5338403738c0eae7a15f32e9fb9e26acb0973ec82e
-
SHA512
ecb5e7a896d29dc6000af8fde581df28050f743e1f543e677504c4c785ed7d17820e2352d462606f7252b92445913c4c8449922e2abfb2e06f4a67fd8c2564a4
-
SSDEEP
6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgIyY+TAQXTHGUMEyP5p6f5jQmG:bbGUMVWlbG
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1020 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE 1020 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\93733f92c8074a4bc30aeb5338403738c0eae7a15f32e9fb9e26acb0973ec82e.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1020