6dcf9151d6ca4049770fcb1265085e31f300cdf2690d8381af4c117d1bf51ff7

Analysis

max time kernel
173s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

鸦岗(一期)项目排水排污工程.xls
Size

108KB
MD5

7fda23c0b94d15f0a9324de860a6114b
SHA1

f6fe8eb1d8639aa801e392173f68796061d4ee7e
SHA256

b237b57457561ba918388123c7d41b6a439e6f9cadf0e59c10dcec5dc927b7cd
SHA512

fb3fe1b03175da3a1f3956008e6d2d690e3d0e5583433184b3f122d6d266a9a5852d059175a233e4baaedd71f0227e7415eeb914578b393b65e62b6936a76302
SSDEEP

1536:LB64/SGuJJJJJJJJJVKscXcZO+0K7gFt8:RwM8

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

424 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE
424	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\鸦岗(一期)项目排水排污工程.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-132-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/424-133-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/424-134-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/424-135-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/424-136-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/424-137-0x00007FFBF3960000-0x00007FFBF3970000-memory.dmp

Filesize
64KB

Download
memory/424-138-0x00007FFBF3960000-0x00007FFBF3970000-memory.dmp

Filesize
64KB

Download
memory/424-140-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/424-141-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/424-142-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/424-143-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download