Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:43
Behavioral task
behavioral1
Sample
e7b65f159fdef307090634d50f5d22e3eaa7f3e6f600a21a40ea2d6ae26b68f0.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e7b65f159fdef307090634d50f5d22e3eaa7f3e6f600a21a40ea2d6ae26b68f0.xls
Resource
win10v2004-20220812-en
General
-
Target
e7b65f159fdef307090634d50f5d22e3eaa7f3e6f600a21a40ea2d6ae26b68f0.xls
-
Size
325KB
-
MD5
43b011a33ee2d40c3a22b31a11ef56d1
-
SHA1
aa234b11838488d367e620cd6c59a5e40016d99f
-
SHA256
e7b65f159fdef307090634d50f5d22e3eaa7f3e6f600a21a40ea2d6ae26b68f0
-
SHA512
28bb9743ff86f4761230807108ad2f025a72287fe0b00d0479df0776a81b82f2345ce006dd0407214291acb48b1b6920692beafb40c4a8ee614da16486524f77
-
SSDEEP
6144:QCYBHpNuHln60IfFvC0lr+VnFcwVgqAkHoJUm1to44Fcs:2iutqh
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File created C:\Program Files\Microsoft Office\Root\Office16\Count.txt EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4904 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4904 EXCEL.EXE 4904 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE 4904 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e7b65f159fdef307090634d50f5d22e3eaa7f3e6f600a21a40ea2d6ae26b68f0.xls"1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4904-133-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4904-134-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4904-135-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4904-136-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4904-137-0x00007FF862050000-0x00007FF862060000-memory.dmpFilesize
64KB
-
memory/4904-138-0x00007FF85FF60000-0x00007FF85FF70000-memory.dmpFilesize
64KB
-
memory/4904-139-0x00007FF85FF60000-0x00007FF85FF70000-memory.dmpFilesize
64KB