31b5df865e37e0984f064397bafac9579ad2a50467318e2949d258148fb1e59e

Analysis

max time kernel
149s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31B5DF865E37E0984F064397BAFAC9579AD2A50467318E2949D258148FB1E59E.xls
Size

255KB
MD5

1a863b0f451e3fa1def58a3764d8c0ca
SHA1

76e981676d22c9fd4332af8a1b75608261f19b25
SHA256

31b5df865e37e0984f064397bafac9579ad2a50467318e2949d258148fb1e59e
SHA512

1ab98498cdf40b6330e403ca86396a2a45a1cd63582a3d7757887d2bd0c6917fa7c46ffc7bfac1621d049f6a005cb1c99236c97ef68b67a269356ff58b77a35e
SSDEEP

6144:6Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgONiwrfx9rNFMMrttRzV5Dz3UxqC8LUcS3:yNbDjP9XH5XIqZLnS3

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4736 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE
4736	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\31B5DF865E37E0984F064397BAFAC9579AD2A50467318E2949D258148FB1E59E.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-132-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download
memory/4736-133-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download
memory/4736-134-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download
memory/4736-135-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download
memory/4736-136-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download
memory/4736-137-0x00007FFE75E50000-0x00007FFE75E60000-memory.dmp

Filesize
64KB

Download
memory/4736-138-0x00007FFE75E50000-0x00007FFE75E60000-memory.dmp

Filesize
64KB

Download
memory/4736-140-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download
memory/4736-141-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download
memory/4736-142-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download
memory/4736-143-0x00007FFE78230000-0x00007FFE78240000-memory.dmp

Filesize
64KB

Download