eb9a7b82c9366b324df9fa233018245df9141c65b6f987b3abe12e99ea377054

Analysis

max time kernel
159s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb9a7b82c9366b324df9fa233018245df9141c65b6f987b3abe12e99ea377054.xls
Size

100KB
MD5

e9b2d82f97dc682f9e1f189a0a5d5d44
SHA1

be5728db9fb33fe44279c85fd952b87abec7174b
SHA256

eb9a7b82c9366b324df9fa233018245df9141c65b6f987b3abe12e99ea377054
SHA512

5ee9751be35f23f9c8f0c8b28648abe2acc627572c8527882540baf0d5e25e44e31c9efcf9eaff33f65280f1c37b19a4f0adcc4551334a7a3fc7f1d4a60f7427
SSDEEP

3072:nNl6Nc7yRzs1H75wkZUgsQ6NqTBun5ox2jcc0lbxOrn/vX1qiRb:Nl6Nc7yRzs1H75wkZUgsQ6NqTBun5oIJ

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3588 EXCEL.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXE

pid process

3588 EXCEL.EXE
3588 EXCEL.EXE
3588 EXCEL.EXE
3588 EXCEL.EXE

pid	process
3588	EXCEL.EXE

pid	process
3588	EXCEL.EXE
3588	EXCEL.EXE
3588	EXCEL.EXE
3588	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eb9a7b82c9366b324df9fa233018245df9141c65b6f987b3abe12e99ea377054.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3588-132-0x00007FF8C0C50000-0x00007FF8C0C60000-memory.dmp

Filesize
64KB

Download
memory/3588-133-0x00007FF8C0C50000-0x00007FF8C0C60000-memory.dmp

Filesize
64KB

Download
memory/3588-134-0x00007FF8C0C50000-0x00007FF8C0C60000-memory.dmp

Filesize
64KB

Download
memory/3588-135-0x00007FF8C0C50000-0x00007FF8C0C60000-memory.dmp

Filesize
64KB

Download
memory/3588-136-0x00007FF8C0C50000-0x00007FF8C0C60000-memory.dmp

Filesize
64KB

Download
memory/3588-137-0x00007FF8BE900000-0x00007FF8BE910000-memory.dmp

Filesize
64KB

Download
memory/3588-138-0x00007FF8BE900000-0x00007FF8BE910000-memory.dmp

Filesize
64KB

Download