Overview
overview
1Static
static
资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...23.xls
windows7-x64
1资料/12�...23.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...15.xls
windows7-x64
1资料/12�...15.xls
windows10-2004-x64
1资料/12�...�2.xls
windows7-x64
1资料/12�...�2.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...�2.xls
windows7-x64
1资料/12�...�2.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1资料/12�...��.xls
windows7-x64
1资料/12�...��.xls
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:25
Static task
static1
Behavioral task
behavioral1
Sample
资料/12月、1月预订单退货率分析/南京中央.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
资料/12月、1月预订单退货率分析/南京中央.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
资料/12月、1月预订单退货率分析/南通八佰伴退货率原因分析12.23.xls
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
资料/12月、1月预订单退货率分析/南通八佰伴退货率原因分析12.23.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
资料/12月、1月预订单退货率分析/宿城分公司.xls
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
资料/12月、1月预订单退货率分析/宿城分公司.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
资料/12月、1月预订单退货率分析/宿城分公司12.9-12.15.xls
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
资料/12月、1月预订单退货率分析/宿城分公司12.9-12.15.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
资料/12月、1月预订单退货率分析/宿城分公司2.xls
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
资料/12月、1月预订单退货率分析/宿城分公司2.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
资料/12月、1月预订单退货率分析/徐州百大.xls
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
资料/12月、1月预订单退货率分析/徐州百大.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
资料/12月、1月预订单退货率分析/徐州百大2.xls
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
资料/12月、1月预订单退货率分析/徐州百大2.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
资料/12月、1月预订单退货率分析/江苏四区9-15号退货分析.xls
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
资料/12月、1月预订单退货率分析/江苏四区9-15号退货分析.xls
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
资料/12月、1月预订单退货率分析/淮安中央12月退货率分析.xls
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
资料/12月、1月预订单退货率分析/淮安中央12月退货率分析.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
资料/12月、1月预订单退货率分析/预订单1月1号(导出新系统上线后未交货).xls
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
资料/12月、1月预订单退货率分析/预订单1月1号(导出新系统上线后未交货).xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
资料/12月考勤/江苏一区/江都商城.xls
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
资料/12月考勤/江苏一区/江都商城.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
资料/12月考勤/江苏三区/南通八佰伴.xls
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
资料/12月考勤/江苏三区/南通八佰伴.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
资料/12月考勤/江苏三区/南通文峰.xls
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
资料/12月考勤/江苏三区/南通文峰.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
资料/12月考勤/江苏三区/南通金鹰.xls
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
资料/12月考勤/江苏三区/南通金鹰.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
资料/12月考勤/江苏二区/南京同曦(万尚城).xls
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
资料/12月考勤/江苏二区/南京同曦(万尚城).xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
资料/12月考勤/江苏二区/盐城商厦.xls
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
资料/12月考勤/江苏二区/盐城商厦.xls
Resource
win10v2004-20221111-en
General
-
Target
资料/12月、1月预订单退货率分析/徐州百大2.xls
-
Size
38KB
-
MD5
3051132f2b74c2cac081278661b60c82
-
SHA1
f96e192f8a6899b0283840b54b348ab5b3489580
-
SHA256
88b4e6224b416660cfd95cbeb048050d1cda5b010c83024b15c3bca1ec1f1066
-
SHA512
83f501c236938884df20a8e0db0f35fff9d96638512a64e95883a88ecccb57a96f23f9aa019151ed8ce4ccac66295309f5f3bf465ed754d4c35a10feb581ddfb
-
SSDEEP
768:S3333WaizET7lC3zoRID8dDvR2huZ95aLFJI0NdB:S3333WaizET7lC3zoRID8dDauZ95av
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2640 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
EXCEL.EXEpid process 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE 2640 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\资料\12月、1月预订单退货率分析\徐州百大2.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2640-132-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/2640-133-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/2640-134-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/2640-135-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/2640-136-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/2640-137-0x00007FF9D24F0000-0x00007FF9D2500000-memory.dmpFilesize
64KB
-
memory/2640-138-0x00007FF9D24F0000-0x00007FF9D2500000-memory.dmpFilesize
64KB
-
memory/2640-141-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/2640-142-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/2640-140-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/2640-143-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB