Analysis
-
max time kernel
154s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
903aff29b130c7047da714afa2980213dd5661d124eebe3e227f68042527c4a4.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
903aff29b130c7047da714afa2980213dd5661d124eebe3e227f68042527c4a4.xls
Resource
win10v2004-20221111-en
General
-
Target
903aff29b130c7047da714afa2980213dd5661d124eebe3e227f68042527c4a4.xls
-
Size
10KB
-
MD5
e4139f4e1835eac42baf5e06879011f1
-
SHA1
08ecc228415ef7ce1de61311dafde13e2d4606ec
-
SHA256
903aff29b130c7047da714afa2980213dd5661d124eebe3e227f68042527c4a4
-
SHA512
bc58ef94ee35db19af19995252d07f8f170cc3c67f94c04f4867f1db0ce0b928016de7eee0535aca4d166c52c6558fafec4ec775a6d75f88758517f84aa7da11
-
SSDEEP
192:Xop42p42p42t8wth8hhPPPPPPPPPPG8RtFsNV3+PFxq:4BBBt8C3+PFxq
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3064 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE 3064 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\903aff29b130c7047da714afa2980213dd5661d124eebe3e227f68042527c4a4.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3064