b317746be65f640bf759bf554376733822291f763c3e9cca49d0c8ac4892e251

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AWB BL CI Document.xls
Size

761KB
MD5

7c72863c8a8f132ea8ffa2d722893b4a
SHA1

8f31f881f55f96542dbcc90a4f826a64b4dc4b89
SHA256

b317746be65f640bf759bf554376733822291f763c3e9cca49d0c8ac4892e251
SHA512

07f2b7062b424be260257392f2a624d8da9e1eef549f5644c6527ce1aede2121e9a25525ae527e6afb3f73dab46c0b3f77e228fe11316f61f6dbfda0b7c4511e
SSDEEP

12288:ZIN3rDx7XXXXXXXXXXXXUXXXXXXXqXXXXXXXXiTmXbIN3rDx7XXXXXXXXXXXXUX2:or5XXXXXXXXXXXXUXXXXXXXqXXXXXXXk

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3300 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\AWB BL CI Document.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3300-132-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download
memory/3300-133-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download
memory/3300-134-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download
memory/3300-135-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download
memory/3300-136-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download
memory/3300-137-0x00007FF83A260000-0x00007FF83A270000-memory.dmp

Filesize
64KB

Download
memory/3300-138-0x00007FF83A260000-0x00007FF83A270000-memory.dmp

Filesize
64KB

Download
memory/3300-140-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download
memory/3300-141-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download
memory/3300-142-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download
memory/3300-143-0x00007FF83C790000-0x00007FF83C7A0000-memory.dmp

Filesize
64KB

Download