Resubmissions
23-11-2022 09:31
221123-lhbnvsbd44 823-11-2022 09:26
221123-leamdsba93 823-11-2022 08:51
221123-kr9ftahe59 8Analysis
-
max time kernel
230s -
max time network
229s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:26
Behavioral task
behavioral1
Sample
6_IT05055349816_04_23112022_098000.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6_IT05055349816_04_23112022_098000.xls
Resource
win10v2004-20221111-en
General
-
Target
6_IT05055349816_04_23112022_098000.xls
-
Size
70KB
-
MD5
8a4506de9bcc7b0841edc087a2936942
-
SHA1
94490ba077aba51333b8afaa41aa40fe096edd55
-
SHA256
448b35ad2bfeb1353a5b668b7cbb140d9ad958d5f9ab7a426f9eb8e1a6e8b545
-
SHA512
e66bff3ff137aad1cb1515de0d2081306986c91d65395dae9f4c3b9814aed122f7e56177da603fbb92da77ed5e1ce00a99e6770c041729701b85ffe9274e18e1
-
SSDEEP
1536:fDlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0ad50+99rHk+wTWOWhMBG5/mu:fDlYkEIuPm3fNRZmbaoFhZhR0cixIHml
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1196 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE 1196 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6_IT05055349816_04_23112022_098000.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1196-132-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/1196-133-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/1196-134-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/1196-135-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/1196-136-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/1196-137-0x00007FF8838B0000-0x00007FF8838C0000-memory.dmpFilesize
64KB
-
memory/1196-138-0x00007FF8838B0000-0x00007FF8838C0000-memory.dmpFilesize
64KB