Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 11:41
Behavioral task
behavioral1
Sample
64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3.xls
Resource
win10v2004-20220901-en
General
-
Target
64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3.xls
-
Size
107KB
-
MD5
10a55477cca9dd8c9a3b1c45790d1374
-
SHA1
9b5a9de959281c78c986cb77398ca8fe7acfb546
-
SHA256
64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3
-
SHA512
2b335c996c157954203f7b5f0b62e03f0ef4afd8732e18ea7960533a9074faf028f93877da20bfbe27ee2f6dd022ed020c4a2eb78fcfdf46f4a565433a387d66
-
SSDEEP
1536:YlllJMlDN1HZ/PERhwYZrrMs7Gu/XoHGkPrMsl/COR/vVf3Gwmsij9wDjppVMhua:DvVfmSWcwH7wDbT2J
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3404 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
EXCEL.EXEpid process 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE 3404 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 3404 wrote to memory of 4804 3404 EXCEL.EXE splwow64.exe PID 3404 wrote to memory of 4804 3404 EXCEL.EXE splwow64.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\64b6ed4b24fe1da20f8e51e7a6850eba4a5281d2cbbed16b5fd634677e6cf9e3.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3404-132-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmpFilesize
64KB
-
memory/3404-134-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmpFilesize
64KB
-
memory/3404-133-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmpFilesize
64KB
-
memory/3404-135-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmpFilesize
64KB
-
memory/3404-136-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmpFilesize
64KB
-
memory/3404-137-0x00007FF8D50A0000-0x00007FF8D50B0000-memory.dmpFilesize
64KB
-
memory/3404-138-0x00007FF8D50A0000-0x00007FF8D50B0000-memory.dmpFilesize
64KB
-
memory/4804-139-0x0000000000000000-mapping.dmp