0fed7d48f603e74e2dee5229d4f20b11177d08d9849c0d65e04255b8150fa80d

Analysis

max time kernel
187s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0FED7D48F603E74E2DEE5229D4F20B11177D08D9849C0D65E04255B8150FA80D.xls
Size

255KB
MD5

a046e01d0082012b4d2bb36d60391163
SHA1

95b59e6e18e3cb9b65114b1b9b2639df92d4c2ca
SHA256

0fed7d48f603e74e2dee5229d4f20b11177d08d9849c0d65e04255b8150fa80d
SHA512

414a2bcaa8435946d83ee467a3c02b3d9948536ef4288cbf9983ff04697f9d4c5a6576d1cb87b06acea75f0e1c3d770cc23bbd15d6b4c716488ca4c6dfc360fd
SSDEEP

6144:6Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg4Niwrfx9rNFMMrttRzV5Dz3UxqC8LUcSE:0NbDjP9XH5XIqZLnSE

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4936 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE
4936	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0FED7D48F603E74E2DEE5229D4F20B11177D08D9849C0D65E04255B8150FA80D.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4936-132-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download
memory/4936-133-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download
memory/4936-134-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download
memory/4936-135-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download
memory/4936-136-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download
memory/4936-137-0x00007FF979000000-0x00007FF979010000-memory.dmp

Filesize
64KB

Download
memory/4936-138-0x00007FF979000000-0x00007FF979010000-memory.dmp

Filesize
64KB

Download
memory/4936-140-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download
memory/4936-141-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download
memory/4936-142-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download
memory/4936-143-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Filesize
64KB

Download