Analysis
-
max time kernel
153s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:22
Static task
static1
Behavioral task
behavioral1
Sample
b29a22511e2b072d93d74061712a67c74bf6252a387a481cdb74cc97a6a1c696.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b29a22511e2b072d93d74061712a67c74bf6252a387a481cdb74cc97a6a1c696.xls
Resource
win10v2004-20221111-en
General
-
Target
b29a22511e2b072d93d74061712a67c74bf6252a387a481cdb74cc97a6a1c696.xls
-
Size
13KB
-
MD5
60a88e8c05b58fa428a7401396589dec
-
SHA1
33ad572bff7a50ada6f066939a2e6dd4a499aa25
-
SHA256
b29a22511e2b072d93d74061712a67c74bf6252a387a481cdb74cc97a6a1c696
-
SHA512
c3bad4e2bc52252c5b3fb673ef57938f4cd34f3090055af80c9aff41748f2c4b9e7a6ed2a4af03bf67dd92d1539b844161fe7ce23a87895898e6179ad85dd6d8
-
SSDEEP
48:rYLZgDTRmzXS39j7tmFhacg4fVqJcUyU3+:UqDdmmh7QOcUcyO
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 696 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE 696 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b29a22511e2b072d93d74061712a67c74bf6252a387a481cdb74cc97a6a1c696.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:696