Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 12:42
Static task
static1
Behavioral task
behavioral1
Sample
19062314900686106436ca9fa9aa97bad6b10964a40dee7092238b4c453cd3b6.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
19062314900686106436ca9fa9aa97bad6b10964a40dee7092238b4c453cd3b6.xls
Resource
win10v2004-20220812-en
General
-
Target
19062314900686106436ca9fa9aa97bad6b10964a40dee7092238b4c453cd3b6.xls
-
Size
173KB
-
MD5
ae8dbbda27534739699ff3275154868f
-
SHA1
282a769210ae73f2124c2aab87f3ec815cfed089
-
SHA256
19062314900686106436ca9fa9aa97bad6b10964a40dee7092238b4c453cd3b6
-
SHA512
77f6d1eab8c6d6bdb84999df80870458705c83c17669755a23fbcb7fbc72332f0745272e7a3dbf3c26123526d47547085763b80a10cd5ce04fece389020f17f8
-
SSDEEP
3072:yjl22222222222222222222222222IDtc+fzF8hZld5pW3pfdfhwtRtRFpWXpbhF:yj4c+58hZld5pW3pfdfhwtRtRFpWXpbv
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4548 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\19062314900686106436ca9fa9aa97bad6b10964a40dee7092238b4c453cd3b6.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4548