Analysis
-
max time kernel
115s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2023 17:28
Behavioral task
behavioral1
Sample
Comprobant.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Comprobant.xls
Resource
win10v2004-20221111-en
General
-
Target
Comprobant.xls
-
Size
64KB
-
MD5
ff489ab462ca00e089503283dd83888e
-
SHA1
5608b77b509bbfa4ae88c3a426591a0913fd1e2c
-
SHA256
ebf3394f6ce4969ede9d837e55859ad751e02b46f795eae697fabec92d3252a1
-
SHA512
76a93057a63def3206848687ce269bbbba2d7fb9e3031a8b67da7dcbe133792101638acc9057afc2a5c8b86646444119f0b59c5b90b89b0919530b5f5256e434
-
SSDEEP
1536:RrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAUPdbQ44Oh0C:RrxEtjPOtioVjDGUU1qfDlaGGx+cL2Qd
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
LXEBKCNFK.exeLXEBKCNFK.exepid process 2192 LXEBKCNFK.exe 1944 LXEBKCNFK.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LXEBKCNFK.exedescription pid process target process PID 2192 set thread context of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3428 1944 WerFault.exe LXEBKCNFK.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3448 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
LXEBKCNFK.exedescription pid process Token: SeDebugPrivilege 2192 LXEBKCNFK.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
EXCEL.EXELXEBKCNFK.exedescription pid process target process PID 3448 wrote to memory of 2192 3448 EXCEL.EXE LXEBKCNFK.exe PID 3448 wrote to memory of 2192 3448 EXCEL.EXE LXEBKCNFK.exe PID 3448 wrote to memory of 2192 3448 EXCEL.EXE LXEBKCNFK.exe PID 2192 wrote to memory of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe PID 2192 wrote to memory of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe PID 2192 wrote to memory of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe PID 2192 wrote to memory of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe PID 2192 wrote to memory of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe PID 2192 wrote to memory of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe PID 2192 wrote to memory of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe PID 2192 wrote to memory of 1944 2192 LXEBKCNFK.exe LXEBKCNFK.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Comprobant.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LXEBKCNFK.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LXEBKCNFK.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LXEBKCNFK.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LXEBKCNFK.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1944 -ip 19441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LXEBKCNFK.exeFilesize
878KB
MD59d6bb03b177aba8b924d845fb31f0e33
SHA1d4155e8901742b509828bac96b8126365e3a9b97
SHA25678dba4330a89c61f3d91ed3601818ec3f4f2830b4a608526bf746103f0f1dcb3
SHA51289653795be23cbd35803173afdc66a35f54c72900fd870edeab7e9bd0cda56cef1604edfee4e4c799f46ed4b94b897d101f6c4fcc34a1d46eff410393bf64fac
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LXEBKCNFK.exeFilesize
878KB
MD59d6bb03b177aba8b924d845fb31f0e33
SHA1d4155e8901742b509828bac96b8126365e3a9b97
SHA25678dba4330a89c61f3d91ed3601818ec3f4f2830b4a608526bf746103f0f1dcb3
SHA51289653795be23cbd35803173afdc66a35f54c72900fd870edeab7e9bd0cda56cef1604edfee4e4c799f46ed4b94b897d101f6c4fcc34a1d46eff410393bf64fac
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LXEBKCNFK.exeFilesize
878KB
MD59d6bb03b177aba8b924d845fb31f0e33
SHA1d4155e8901742b509828bac96b8126365e3a9b97
SHA25678dba4330a89c61f3d91ed3601818ec3f4f2830b4a608526bf746103f0f1dcb3
SHA51289653795be23cbd35803173afdc66a35f54c72900fd870edeab7e9bd0cda56cef1604edfee4e4c799f46ed4b94b897d101f6c4fcc34a1d46eff410393bf64fac
-
memory/1944-146-0x0000000000000000-mapping.dmp
-
memory/2192-142-0x0000000000360000-0x0000000000440000-memory.dmpFilesize
896KB
-
memory/2192-143-0x000000000A670000-0x000000000A70C000-memory.dmpFilesize
624KB
-
memory/2192-145-0x000000000A7B0000-0x000000000A842000-memory.dmpFilesize
584KB
-
memory/2192-139-0x0000000000000000-mapping.dmp
-
memory/2192-144-0x000000000ACC0000-0x000000000B264000-memory.dmpFilesize
5.6MB
-
memory/3448-136-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB
-
memory/3448-132-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB
-
memory/3448-135-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB
-
memory/3448-137-0x00007FFCDB720000-0x00007FFCDB730000-memory.dmpFilesize
64KB
-
memory/3448-138-0x00007FFCDB720000-0x00007FFCDB730000-memory.dmpFilesize
64KB
-
memory/3448-134-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB
-
memory/3448-133-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB
-
memory/3448-150-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB
-
memory/3448-151-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB
-
memory/3448-152-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB
-
memory/3448-153-0x00007FFCDDAD0000-0x00007FFCDDAE0000-memory.dmpFilesize
64KB