Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 16:29
Behavioral task
behavioral1
Sample
1c4078c97c0d03d8b230b531bf9c208240cddebba5342f4a5bcf15726b988089.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1c4078c97c0d03d8b230b531bf9c208240cddebba5342f4a5bcf15726b988089.xls
Resource
win10v2004-20220812-en
General
-
Target
1c4078c97c0d03d8b230b531bf9c208240cddebba5342f4a5bcf15726b988089.xls
-
Size
4.8MB
-
MD5
9346f374fcf7cde92df01b5b6dd698ce
-
SHA1
65e1a521f28b77fe0e6bc618652e18c063c7cb59
-
SHA256
1c4078c97c0d03d8b230b531bf9c208240cddebba5342f4a5bcf15726b988089
-
SHA512
e875992f19e5cdb0993d373732b95ec572a50e348ef67fd3c580b196ee297b4fd7b8796a1395f992a0a9451a7bca90a6acc3c93c27b22981621d9cc3db30fe73
-
SSDEEP
98304:sv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXY:svpvFa+g8RWLdPk/84tCEr0RtNiC5eS9
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3060 EXCEL.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
EXCEL.EXEpid process 3060 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
EXCEL.EXEpid process 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE 3060 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1c4078c97c0d03d8b230b531bf9c208240cddebba5342f4a5bcf15726b988089.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3060-132-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB
-
memory/3060-133-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB
-
memory/3060-134-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB
-
memory/3060-135-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB
-
memory/3060-136-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB
-
memory/3060-137-0x00007FFE81370000-0x00007FFE81380000-memory.dmpFilesize
64KB
-
memory/3060-138-0x00007FFE81370000-0x00007FFE81380000-memory.dmpFilesize
64KB
-
memory/3060-139-0x0000017C2D630000-0x0000017C2D634000-memory.dmpFilesize
16KB
-
memory/3060-140-0x0000017C30D7F000-0x0000017C30D81000-memory.dmpFilesize
8KB
-
memory/3060-142-0x0000017C30ED3000-0x0000017C30ED5000-memory.dmpFilesize
8KB
-
memory/3060-141-0x0000017C30D80000-0x0000017C30D82000-memory.dmpFilesize
8KB
-
memory/3060-143-0x0000017C30D7F000-0x0000017C30D81000-memory.dmpFilesize
8KB
-
memory/3060-144-0x0000017C30ED3000-0x0000017C30ED5000-memory.dmpFilesize
8KB
-
memory/3060-145-0x0000017C30D4F000-0x0000017C30D51000-memory.dmpFilesize
8KB
-
memory/3060-147-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB
-
memory/3060-148-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB
-
memory/3060-149-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB
-
memory/3060-150-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmpFilesize
64KB