Analysis
-
max time kernel
101s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2023, 12:23
Behavioral task
behavioral1
Sample
772461.xls
Resource
win7-20221111-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
772461.xls
Resource
win10v2004-20221111-en
4 signatures
150 seconds
General
-
Target
772461.xls
-
Size
91KB
-
MD5
77ab6ac40b4b4db8efa297534eb8d23f
-
SHA1
dc01f959acff2ff1aae1278f7de74f2e9d1d3857
-
SHA256
d1cc51309cddfeeb4181c3aafdc35e72c2ecb219e006392cae96b8568a4246ae
-
SHA512
94d9070a736d4f705c5163a8b4e478faaaa162356de53bbd9ed8da4f295f92bd2cc89cbd71a046eb6ccf12210db6646da8821ab98c52dbf07035a6f6630a812a
-
SSDEEP
1536:JblYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0QOYVEiYqb4c+DoW47zo4doT3aX:JblYkEIuPm3fNRZmbaoFhZhR0cixIHmv
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4640 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\772461.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4640