Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 11:56
Behavioral task
behavioral1
Sample
2894ad6bef05b0bba2c6f56194f7402c5535b03c7bedda7df7065269cd52cb39.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2894ad6bef05b0bba2c6f56194f7402c5535b03c7bedda7df7065269cd52cb39.xls
Resource
win10v2004-20220812-en
General
-
Target
2894ad6bef05b0bba2c6f56194f7402c5535b03c7bedda7df7065269cd52cb39.xls
-
Size
86KB
-
MD5
3b21e1fb5d4fb2d67bcfc716a57ad41c
-
SHA1
ea32281a99da84426ad74ba5579f0cc1bf3b6d2f
-
SHA256
2894ad6bef05b0bba2c6f56194f7402c5535b03c7bedda7df7065269cd52cb39
-
SHA512
c462a4db94e9b3b0a90b820233d8d6858206241f355c14e91f9b9071d6817959c781d7eec594a36f8a9d38724e71b7418f86630df6cb2c5d9857052a9138c1ee
-
SSDEEP
768:x+LbCU7xRpInb4B0jhJbk6OFG2wOREVckWYFde9OLt5lbpTu275D:+pInb4BmkdFG3OREVoKe9GtHpx1D
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 448 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE 448 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2894ad6bef05b0bba2c6f56194f7402c5535b03c7bedda7df7065269cd52cb39.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/448-132-0x00007FFE76630000-0x00007FFE76640000-memory.dmpFilesize
64KB
-
memory/448-133-0x00007FFE76630000-0x00007FFE76640000-memory.dmpFilesize
64KB
-
memory/448-134-0x00007FFE76630000-0x00007FFE76640000-memory.dmpFilesize
64KB
-
memory/448-135-0x00007FFE76630000-0x00007FFE76640000-memory.dmpFilesize
64KB
-
memory/448-136-0x00007FFE76630000-0x00007FFE76640000-memory.dmpFilesize
64KB
-
memory/448-137-0x00007FFE74320000-0x00007FFE74330000-memory.dmpFilesize
64KB
-
memory/448-138-0x00007FFE74320000-0x00007FFE74330000-memory.dmpFilesize
64KB