Analysis
-
max time kernel
119s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
(csak 32bit számítógépekhez) advice_statement_37741572.xll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
(csak 32bit számítógépekhez) advice_statement_37741572.xll
Resource
win10v2004-20220901-en
General
-
Target
(csak 32bit számítógépekhez) advice_statement_37741572.xll
-
Size
634KB
-
MD5
df169d15769c7f56cecfef517aee8a6b
-
SHA1
0a52d8114a60fdb56d6c6fe1e3276274228ea979
-
SHA256
ea2e9bdd8648623e1df089574eb77775ce2ec3a3cf03611e6611519be8e40bd5
-
SHA512
51ef26cca75256db146689b1ff16d0831d167e4af985d31be51b9eb06a396da72db864b2c600150c8567d3225e4c37e991a84afe5893a79c152e7a145ce68454
-
SSDEEP
6144:2xOJXk57IMp7oyR4y6Qf3lbp83A6zbKsS5ukTP2YmqteSGUoNnuqZGw+gSe81HE2:2x2s7IMrR4yVld8bzbBSrenuqZGDxE
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5004 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE 5004 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\(csak 32bit számítógépekhez) advice_statement_37741572.xll"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5004