Resubmissions
23-11-2022 09:31
221123-lhbnvsbd44 823-11-2022 09:26
221123-leamdsba93 823-11-2022 08:51
221123-kr9ftahe59 8Analysis
-
max time kernel
494s -
max time network
500s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:31
Behavioral task
behavioral1
Sample
6_IT05055349816_04_23112022_098000.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6_IT05055349816_04_23112022_098000.xls
Resource
win10v2004-20220812-en
General
-
Target
6_IT05055349816_04_23112022_098000.xls
-
Size
70KB
-
MD5
8a4506de9bcc7b0841edc087a2936942
-
SHA1
94490ba077aba51333b8afaa41aa40fe096edd55
-
SHA256
448b35ad2bfeb1353a5b668b7cbb140d9ad958d5f9ab7a426f9eb8e1a6e8b545
-
SHA512
e66bff3ff137aad1cb1515de0d2081306986c91d65395dae9f4c3b9814aed122f7e56177da603fbb92da77ed5e1ce00a99e6770c041729701b85ffe9274e18e1
-
SSDEEP
1536:fDlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0ad50+99rHk+wTWOWhMBG5/mu:fDlYkEIuPm3fNRZmbaoFhZhR0cixIHml
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1096 4912 WerFault.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1052 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE 1052 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6_IT05055349816_04_23112022_098000.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 4912 -ip 49121⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4912 -s 17521⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-132-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmpFilesize
64KB
-
memory/1052-133-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmpFilesize
64KB
-
memory/1052-134-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmpFilesize
64KB
-
memory/1052-135-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmpFilesize
64KB
-
memory/1052-136-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmpFilesize
64KB
-
memory/1052-137-0x00007FFBDA980000-0x00007FFBDA990000-memory.dmpFilesize
64KB
-
memory/1052-138-0x00007FFBDA980000-0x00007FFBDA990000-memory.dmpFilesize
64KB