Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 21:27
Behavioral task
behavioral1
Sample
2dc726b8aa47616b6315d486dd289ba3.xlsm
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2dc726b8aa47616b6315d486dd289ba3.xlsm
Resource
win10v2004-20220812-en
General
-
Target
2dc726b8aa47616b6315d486dd289ba3.xlsm
-
Size
17KB
-
MD5
2dc726b8aa47616b6315d486dd289ba3
-
SHA1
0823f9ea4079f3c43fd79953bddcaf1a4d939f82
-
SHA256
4b51506ee5dd8045f193ca519f96505266ce7108897e4ecee134e96bd95f8f54
-
SHA512
e2401ae3b4e18e857a2330210d153fdbfeb4dcb31ae584b559fe716fac9a58ea98a446d61d9870b2b5a90feb156e9f8da40b6ec5f7f62fba92ded74b92010b75
-
SSDEEP
384:HeEW2Vk1eKrNHj8f9NdNQQKKEM5CxSMDS2OQxEN7UIFhibbwBHtL:+EW2Vk0MWNMKEMb8TOhAWoXmL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4824 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE 4824 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2dc726b8aa47616b6315d486dd289ba3.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4824