fdd33a137aa5e4b3a1b1268297372067e246a8c0d9a812fb691a2d685444308d

Analysis

max time kernel
202s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nuevo_orden.xls
Size

1.4MB
MD5

3ec6082c0c3d4230f50fb5492fca4ce5
SHA1

7785a87183386d911ef22ef01f56a124d5bbb4ed
SHA256

fdd33a137aa5e4b3a1b1268297372067e246a8c0d9a812fb691a2d685444308d
SHA512

09dca1b64c7f43f6855f530462079213ab8ae14f6eb4e70720d236c0ff7407ebd144880ad3f230f6f3c727866377fa75622baf2db476f7270e3ff8110bde516a
SSDEEP

24576:nzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXD+m/Vr5XXXXXXXXXXXXUXXXXXXXrXXXx:I0S/XpWUe

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2552 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE
2552	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Nuevo_orden.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-132-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2552-133-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2552-134-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2552-135-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2552-136-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2552-137-0x00007FF873230000-0x00007FF873240000-memory.dmp

Filesize
64KB

Download
memory/2552-138-0x00007FF873230000-0x00007FF873240000-memory.dmp

Filesize
64KB

Download
memory/2552-140-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2552-141-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2552-142-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2552-143-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download