Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 19:05
Behavioral task
behavioral1
Sample
2d17e49233f7e70b2565e194d42406f1957d04419388f5521120e54962af9726.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2d17e49233f7e70b2565e194d42406f1957d04419388f5521120e54962af9726.xls
Resource
win10v2004-20220901-en
General
-
Target
2d17e49233f7e70b2565e194d42406f1957d04419388f5521120e54962af9726.xls
-
Size
128KB
-
MD5
af332cc90ee2686d7b320697d0ea8c20
-
SHA1
d6f560c7c4220b317e49c96b67db97cb990bf457
-
SHA256
2d17e49233f7e70b2565e194d42406f1957d04419388f5521120e54962af9726
-
SHA512
038780468d3d26606d99562b9955b90204407ecffa72d7f5c044803bbcadc851eba3367343e6c9b8acc3d639258a5cbc1f84e497ea5e60d116df100d35c2999b
-
SSDEEP
1536:96666OSjkPHHfDnMH1xpAgfwMrL6AYJmmctwHJdTMd5Ia4tmd8aYZR+0pbchDBv+:ma4tmiCcH
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4872 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
EXCEL.EXEpid process 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE 4872 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2d17e49233f7e70b2565e194d42406f1957d04419388f5521120e54962af9726.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4872-132-0x00007FF927810000-0x00007FF927820000-memory.dmpFilesize
64KB
-
memory/4872-133-0x00007FF927810000-0x00007FF927820000-memory.dmpFilesize
64KB
-
memory/4872-134-0x00007FF927810000-0x00007FF927820000-memory.dmpFilesize
64KB
-
memory/4872-135-0x00007FF927810000-0x00007FF927820000-memory.dmpFilesize
64KB
-
memory/4872-136-0x00007FF927810000-0x00007FF927820000-memory.dmpFilesize
64KB
-
memory/4872-137-0x00007FF925010000-0x00007FF925020000-memory.dmpFilesize
64KB
-
memory/4872-138-0x00007FF925010000-0x00007FF925020000-memory.dmpFilesize
64KB