Behavioral Report

Analysis

max time kernel
155s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:41

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

BF829517A6DAC2F780968DF6DB5B212A01EC269A353376EAA1B7D6EB306DCC9F.xls
Size

91KB
MD5

c44facac840cd5d8286c0a771dc0df4d
SHA1

bea1524c9dcbdeb63ab6073dae60ad071ad5db2c
SHA256

bf829517a6dac2f780968df6db5b212a01ec269a353376eaa1b7d6eb306dcc9f
SHA512

8e6f752450612fbe4d555e4f4e0372f62778311bf77740a8d0352a5b3861dc334e6d0c1ab953f2e82456884f8f6a498eabf3f17d540aa0a1acef4320d5a71ae5
SSDEEP

1536:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHbCXuZH4gb4CEn9J4ZPX5:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgl

Score

1^/10

Malware Config

Signatures

Checks processor information in registry ⋅ 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry ⋅ 2 TTPs 3 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener ⋅ 1 IoCs

Processes:

EXCEL.EXE

pid process

2304 EXCEL.EXE

Suspicious use of SetWindowsHookEx ⋅ 12 IoCs

Processes:

EXCEL.EXE

pid	process
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE
2304	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\BF829517A6DAC2F780968DF6DB5B212A01EC269A353376EAA1B7D6EB306DCC9F.xls"

Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx

PID:2304

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/2304-132-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download
memory/2304-133-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download
memory/2304-134-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download
memory/2304-135-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download
memory/2304-136-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download
memory/2304-137-0x00007FFEB5DC0000-0x00007FFEB5DD0000-memory.dmp

Download
memory/2304-138-0x00007FFEB5DC0000-0x00007FFEB5DD0000-memory.dmp

Download
memory/2304-140-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download
memory/2304-141-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download
memory/2304-142-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download
memory/2304-143-0x00007FFEB8610000-0x00007FFEB8620000-memory.dmp

Download