3460e5dd4b30fc83d1e91db11e042241a21003cec53ee43967d739ee41220163

Analysis

max time kernel
165s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3460e5dd4b30fc83d1e91db11e042241a21003cec53ee43967d739ee41220163.exe
Size

3.8MB
MD5

b0f15eb5e18d4237892d0f3eae59b53f
SHA1

fb45600932d22c80081427c849aebabf3873984b
SHA256

3460e5dd4b30fc83d1e91db11e042241a21003cec53ee43967d739ee41220163
SHA512

3ba0f721b100c0eff68a3a607e2b53292575f2650fdb92cf15d3e7bf9de57b805e923a78e73a109f2d72016e17c8e6a9fb8e142b825677478c93e995f5650cc5
SSDEEP

24576:DA2PXjisi+AbCru5tp7yGURSwUJXJEKNyPj08kYIGJG3kJwTZQpcxgqadql/8ADe:kGTiawCrNlFwTOpcyqVo

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\E½î¸¨Öú¹¤¾ßÏä.xls	office_macro_on_action

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

644 EXCEL.EXE

pid	process
644	EXCEL.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

3460e5dd4b30fc83d1e91db11e042241a21003cec53ee43967d739ee41220163.exeEXCEL.EXE

pid	process
1532	3460e5dd4b30fc83d1e91db11e042241a21003cec53ee43967d739ee41220163.exe
644	EXCEL.EXE
644	EXCEL.EXE
644	EXCEL.EXE
644	EXCEL.EXE
644	EXCEL.EXE
644	EXCEL.EXE

C:\Users\Admin\AppData\Local\Temp\3460e5dd4b30fc83d1e91db11e042241a21003cec53ee43967d739ee41220163.exe
"C:\Users\Admin\AppData\Local\Temp\3460e5dd4b30fc83d1e91db11e042241a21003cec53ee43967d739ee41220163.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E½î¸¨Öú¹¤¾ßÏä.xls
Filesize
3.8MB

MD5
ca51eaa5ac94685cc8266f1f2a60894b

SHA1
d6b8dfc73e4c2ce12c8ceb80a36f0659acc9bb31

SHA256
eb91afd9e9ceb5c66633d07b4097961015cec530b7f759291cf43296e34750fb

SHA512
5adce1eeb82ec3e071570244bd5c71df8f2d1f1cbb2954d57b1403815eb3d3f6379c010642e354674dda9cb3bed53e1c0a390318384aab2afe2f5683175d6c9f

Download Submit
memory/644-134-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download
memory/644-135-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download
memory/644-136-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download
memory/644-137-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download
memory/644-138-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download
memory/644-139-0x00007FF7F7930000-0x00007FF7F7940000-memory.dmp

Filesize
64KB

Download
memory/644-140-0x00007FF7F7930000-0x00007FF7F7940000-memory.dmp

Filesize
64KB

Download
memory/644-143-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download
memory/644-144-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download
memory/644-145-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download
memory/644-146-0x00007FF7FA290000-0x00007FF7FA2A0000-memory.dmp

Filesize
64KB

Download