Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2022, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
236c28ab2e599f5a804721ff39071f81da2885831cb8d34221bc02d87898c7c4.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
236c28ab2e599f5a804721ff39071f81da2885831cb8d34221bc02d87898c7c4.xls
Resource
win10v2004-20220812-en
General
-
Target
236c28ab2e599f5a804721ff39071f81da2885831cb8d34221bc02d87898c7c4.xls
-
Size
512KB
-
MD5
8a033b04c15ef1614274c41a29b8c26a
-
SHA1
7f139980afba22ec04a148dcdde1fc1ab96c78b0
-
SHA256
236c28ab2e599f5a804721ff39071f81da2885831cb8d34221bc02d87898c7c4
-
SHA512
20368ab9a49c0b9c14eccae088ced92dce3d095741fa528e6c50f465f95ecfe4a8767b10657ea9e26334b2068b114b9d1462ebd50cfc74c1cff4a01016ab0d8c
-
SSDEEP
12288:GdNqrDx7XXXXXXXXXXXXUXXXXXXXrXXXXXXXXEmYcTmFTm1BGcYL//8ra9UohA:Vr5XXXXXXXXXXXXUXXXXXXXrXXXXXXXB
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4800 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4800 EXCEL.EXE 4800 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE 4800 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\236c28ab2e599f5a804721ff39071f81da2885831cb8d34221bc02d87898c7c4.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4800