Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2022, 20:07
Behavioral task
behavioral1
Sample
09112022.xls
Resource
win7-20220901-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
09112022.xls
Resource
win10v2004-20220812-en
5 signatures
150 seconds
General
-
Target
09112022.xls
-
Size
91KB
-
MD5
d405a8cacb7f8fd3f84b710ce2c786ec
-
SHA1
87bbae07712e78232843875fab976e8dfa2c3e57
-
SHA256
9e7eaf569c8f3dbe07baae8cb1e136e70adf653f70c4dd07f21de95be8ec33bc
-
SHA512
8d1b33f7d2f291a96623579f76fa9f21086338bdb48e9a02146192e03cbadc2683943a46626b315373e683edf2729f7109a2293f2536bd685985c1168420fa83
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4Z8EM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgV
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{509B5831-18C1-46BC-8C0E-B8763F3D6440}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6C4F7B02-0019-48A0-AE39-4729DF577B5D}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2228 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE 2228 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\09112022.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2228
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2448