Analysis
-
max time kernel
100s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2023 02:28
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Exploit.MathType-Obfs.Gen.382.16964.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Exploit.MathType-Obfs.Gen.382.16964.xls
Resource
win10v2004-20220812-en
General
-
Target
SecuriteInfo.com.Exploit.MathType-Obfs.Gen.382.16964.xls
-
Size
185KB
-
MD5
4c47656c02c88cdec7e454b7566750a3
-
SHA1
efc679a688d27742226754433c026fa9c6a59b12
-
SHA256
64629388f660c5b68375082dfbd9aedb1fd86c7aed1db141a6102bbf5d6f8188
-
SHA512
774f9b4c9176d618c6e95c71ace7c4412e1afb63f4970f0416ed135bacbb6a346f14b28a9d2155854b0db0aaaafac5c8aa7104a8a6da25bdae820c67ecff092c
-
SSDEEP
3072:Ft9hc1Ut9hcu/fZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAiv8FsutHrnvZA9AOUde:Lc1+cunZ+RwPONXoRjDhIcp0fDlavx+5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1932 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1932 EXCEL.EXE 1932 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.MathType-Obfs.Gen.382.16964.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1932-132-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB
-
memory/1932-133-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB
-
memory/1932-134-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB
-
memory/1932-135-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB
-
memory/1932-136-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB
-
memory/1932-137-0x00007FFCA0730000-0x00007FFCA0740000-memory.dmpFilesize
64KB
-
memory/1932-138-0x00007FFCA0730000-0x00007FFCA0740000-memory.dmpFilesize
64KB
-
memory/1932-140-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB
-
memory/1932-141-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB
-
memory/1932-142-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB
-
memory/1932-143-0x00007FFCA2C70000-0x00007FFCA2C80000-memory.dmpFilesize
64KB