Overview
overview
10Static
static
8199a2e0e1b...c0.xls
windows7-x64
10199a2e0e1b...c0.xls
windows10-2004-x64
101c5f2ca983...ac.xls
windows7-x64
101c5f2ca983...ac.xls
windows10-2004-x64
1027a65553a3...ac.xls
windows7-x64
1027a65553a3...ac.xls
windows10-2004-x64
1403e70970c...52.xls
windows7-x64
10403e70970c...52.xls
windows10-2004-x64
10470c6543c2...ac.xls
windows7-x64
10470c6543c2...ac.xls
windows10-2004-x64
105a63ab6f7e...6e.xls
windows7-x64
105a63ab6f7e...6e.xls
windows10-2004-x64
1061e7a5bc6d...61.xls
windows7-x64
1061e7a5bc6d...61.xls
windows10-2004-x64
107f68771114...a7.xls
windows7-x64
107f68771114...a7.xls
windows10-2004-x64
107ffe4ba808...d6.xls
windows7-x64
107ffe4ba808...d6.xls
windows10-2004-x64
108c3cfdd7e1...ed.xls
windows7-x64
108c3cfdd7e1...ed.xls
windows10-2004-x64
10a821b7d549...16.xls
windows7-x64
10a821b7d549...16.xls
windows10-2004-x64
10b0fb5f6486...01.xls
windows7-x64
10b0fb5f6486...01.xls
windows10-2004-x64
10bd310a2a64...a2.xls
windows7-x64
10bd310a2a64...a2.xls
windows10-2004-x64
1Analysis
-
max time kernel
107s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2023 03:26
Behavioral task
behavioral1
Sample
199a2e0e1bb46a5dd8eb3a58aa55de157f6005c65b70245e71cecec4905cc2c0.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
199a2e0e1bb46a5dd8eb3a58aa55de157f6005c65b70245e71cecec4905cc2c0.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
1c5f2ca9839078742383b207721ce92fdfa70ac50e5d7b73c2488d47f7e5ebac.xls
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
1c5f2ca9839078742383b207721ce92fdfa70ac50e5d7b73c2488d47f7e5ebac.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
27a65553a3560c4e36589cc0da79c8713db4ab009ce4e687b51b302c9d5480ac.xls
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
27a65553a3560c4e36589cc0da79c8713db4ab009ce4e687b51b302c9d5480ac.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
403e70970c9b6f4669f5446607042721caaa2235ebd610c31e1a5f7fc917d752.xls
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
403e70970c9b6f4669f5446607042721caaa2235ebd610c31e1a5f7fc917d752.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
470c6543c277decdbc2ad9f4d825b32e22b6a1ab37fcc337645371a5a3819aac.xls
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
470c6543c277decdbc2ad9f4d825b32e22b6a1ab37fcc337645371a5a3819aac.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
5a63ab6f7ef4d61c6d67fddff5883778b3235ef83b36bfced892d6dbc1a7416e.xls
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
5a63ab6f7ef4d61c6d67fddff5883778b3235ef83b36bfced892d6dbc1a7416e.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
61e7a5bc6dda4cdf7d6c21edbabc61b22a616014d8648a8d43a83d03f5d75d61.xls
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
61e7a5bc6dda4cdf7d6c21edbabc61b22a616014d8648a8d43a83d03f5d75d61.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
7f687711143b9895361fc01c72b0c1090eef0fdb250a1dfa17e35901212cc1a7.xls
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
7f687711143b9895361fc01c72b0c1090eef0fdb250a1dfa17e35901212cc1a7.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
7ffe4ba8088b1e11c2d9579c721467862b9f7bb8d2bc4515be23dcd15036ebd6.xls
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
7ffe4ba8088b1e11c2d9579c721467862b9f7bb8d2bc4515be23dcd15036ebd6.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed.xls
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
a821b7d549ed8c03d8824bad80e2da2c7d212a096a43c82a1cbc3a9308256916.xls
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
a821b7d549ed8c03d8824bad80e2da2c7d212a096a43c82a1cbc3a9308256916.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
b0fb5f6486f17bf63a316d7f3eb85002d6fb74a96cdeb3a9e43f555c73f74d01.xls
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
b0fb5f6486f17bf63a316d7f3eb85002d6fb74a96cdeb3a9e43f555c73f74d01.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
bd310a2a64e17c99fb956a72c31807a7a6120cb0719c203a3dab22ae47bdd8a2.xls
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
bd310a2a64e17c99fb956a72c31807a7a6120cb0719c203a3dab22ae47bdd8a2.xls
Resource
win10v2004-20220812-en
General
-
Target
27a65553a3560c4e36589cc0da79c8713db4ab009ce4e687b51b302c9d5480ac.xls
-
Size
255KB
-
MD5
0d1ea34c0423845842d2411dd5084ae5
-
SHA1
731d92101270c9dbff7b622f0c70eed56a7ddab5
-
SHA256
27a65553a3560c4e36589cc0da79c8713db4ab009ce4e687b51b302c9d5480ac
-
SHA512
8b9d2554a8b445412e55f3234688f6c81c92ed874b0fdf65b8c6c55e451144b2c84f4526309bd43b3f939bb118f5e242f6f3fbc673de84477696febfc2914047
-
SSDEEP
6144:JKpb8rGYrMPe3q7Q0XV5xtuEsi8/dggNiwrfx9rNFMMrttRzV5Dz3UxqC8LUcSq:nNbDjP9XH5XIqZLnSq
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4088 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE 4088 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\27a65553a3560c4e36589cc0da79c8713db4ab009ce4e687b51b302c9d5480ac.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4088-132-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB
-
memory/4088-133-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB
-
memory/4088-134-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB
-
memory/4088-135-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB
-
memory/4088-136-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB
-
memory/4088-137-0x00007FFFBD930000-0x00007FFFBD940000-memory.dmpFilesize
64KB
-
memory/4088-138-0x00007FFFBD930000-0x00007FFFBD940000-memory.dmpFilesize
64KB
-
memory/4088-140-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB
-
memory/4088-141-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB
-
memory/4088-142-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB
-
memory/4088-143-0x00007FFFBFE70000-0x00007FFFBFE80000-memory.dmpFilesize
64KB