Analysis
-
max time kernel
129s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 11:16
Behavioral task
behavioral1
Sample
955afee869ef47574d7c5782fa2b64469653cb0736c3fc01fd2cb7d2540e04fe.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
955afee869ef47574d7c5782fa2b64469653cb0736c3fc01fd2cb7d2540e04fe.xls
Resource
win10v2004-20220812-en
General
-
Target
955afee869ef47574d7c5782fa2b64469653cb0736c3fc01fd2cb7d2540e04fe.xls
-
Size
177KB
-
MD5
5c1790d0f8ed834f489b6b43fe6e30a9
-
SHA1
bd78e7a2e0005ce6caf5dfa06ed91f0cdeb27bcd
-
SHA256
955afee869ef47574d7c5782fa2b64469653cb0736c3fc01fd2cb7d2540e04fe
-
SHA512
dc92d10d52572a6eaf10e6a872ad131e9d18299894a54df1b84acc1cec6a8b6008234accd7a7112120f01094ca51500e6d4897cdb3bc355712e08ab469ec919d
-
SSDEEP
1536:effflJQfUeiaLrM7fgAJLD6d5h6yA7Avu8a5dHa2C9Usdy680ykkP/YwaMQjT0Vw:xykkP/Ywouge2eLgsWHFnBGFm5b
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1824 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE 1824 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\955afee869ef47574d7c5782fa2b64469653cb0736c3fc01fd2cb7d2540e04fe.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-132-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB
-
memory/1824-133-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB
-
memory/1824-134-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB
-
memory/1824-135-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB
-
memory/1824-136-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB
-
memory/1824-137-0x00007FFA43E70000-0x00007FFA43E80000-memory.dmpFilesize
64KB
-
memory/1824-138-0x00007FFA43E70000-0x00007FFA43E80000-memory.dmpFilesize
64KB
-
memory/1824-140-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB
-
memory/1824-141-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB
-
memory/1824-142-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB
-
memory/1824-143-0x00007FFA46370000-0x00007FFA46380000-memory.dmpFilesize
64KB