Overview
overview
4Static
static
报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...��.doc
windows7-x64
4报恩寺�...��.doc
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...��.doc
windows7-x64
4报恩寺�...��.doc
windows10-2004-x64
1报恩寺�...��.doc
windows7-x64
4报恩寺�...��.doc
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1报恩寺�...��.xls
windows7-x64
1报恩寺�...��.xls
windows10-2004-x64
1报恩寺�...1.xlsx
windows7-x64
1报恩寺�...1.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 00:08
Static task
static1
Behavioral task
behavioral1
Sample
报恩寺路设计图/主要经济技术指标表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
报恩寺路设计图/主要经济技术指标表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
报恩寺路设计图/低等级直曲表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
报恩寺路设计图/低等级直曲表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
报恩寺路设计图/土方计算表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
报恩寺路设计图/土方计算表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
报恩寺路设计图/水泥路总说明.doc
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
报恩寺路设计图/水泥路总说明.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
报恩寺路设计图/用地表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
报恩寺路设计图/用地表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
报恩寺路设计图/竖曲线表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
报恩寺路设计图/竖曲线表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
报恩寺路设计图/第一册.doc
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
报恩寺路设计图/第一册.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
报恩寺路设计图/路 基 设 计 表.doc
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
报恩寺路设计图/路 基 设 计 表.doc
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
报恩寺路设计图/路基超高加宽表1.xlsx
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
报恩寺路设计图/路基超高加宽表1.xlsx
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
报恩寺路设计图/路面加宽表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
报恩寺路设计图/路面加宽表1.xlsx
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
报恩寺路设计图/路面工程数量.xls
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
报恩寺路设计图/路面工程数量.xls
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
报恩寺路设计图/逐桩坐标表1.xlsx
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
报恩寺路设计图/逐桩坐标表1.xlsx
Resource
win10v2004-20221111-en
General
-
Target
报恩寺路设计图/主要经济技术指标表1.xlsx
-
Size
22KB
-
MD5
1a3ed0058c984ee723db6a4ac65a4d48
-
SHA1
a0b05740c2e0cc2c5ca8953f37db7286292f4ffc
-
SHA256
6b55de878b28631fe22f9631497ebcc278d9eb008fbd3ebd30533cfe3f5079de
-
SHA512
dec9aafca5f4da35974fc8c1e41a9bd49790eee182ea3b2f2750bd08daecc14204be7fbb9fd9c1ed9a1c55d3360375cde37603b45bb4be4d05c69ceb498b8452
-
SSDEEP
384:jYyqtiQ/IZzlyPSgfLnOqZGT+pkDhP6pBTz4xwWL60obSmEGzeopwL4nyB:Up/vVTOqZGTFV67TMxJ0zXzeac
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1800 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE 1800 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\报恩寺路设计图\主要经济技术指标表1.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1800