7466ce66f882ea4465e88005836b321a112acbda2d353608f97a25650a20b353

Analysis

max time kernel
153s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2022 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7466CE66F882EA4465E88005836B321A112ACBDA2D353608F97A25650A20B353.xls
Size

91KB
MD5

0a1e6f1bf126d7ca7effd1191f1fa2bb
SHA1

e513269b39bc7b5269f88462df165501639d4640
SHA256

7466ce66f882ea4465e88005836b321a112acbda2d353608f97a25650a20b353
SHA512

fc88c874da61074f02c56e857216330237123dbfba204b52928ff97db089dc5069c7d90c0a501ec3d612227acf9612a596a881f81dc0a7ec7294a660448c2e4a
SSDEEP

1536:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgHbCXuZH4gb4CEn9J4ZnX5:vKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4412 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE
4412	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7466CE66F882EA4465E88005836B321A112ACBDA2D353608F97A25650A20B353.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4412-132-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/4412-133-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/4412-134-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/4412-136-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/4412-135-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/4412-137-0x00007FFF15A20000-0x00007FFF15A30000-memory.dmp

Filesize
64KB

Download
memory/4412-138-0x00007FFF15A20000-0x00007FFF15A30000-memory.dmp

Filesize
64KB

Download
memory/4412-140-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/4412-141-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/4412-142-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/4412-143-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download