Analysis
-
max time kernel
163s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 16:29
Behavioral task
behavioral1
Sample
ab330d62f802a2573ccc6dce655a84bea7c54fa7002c94e7a0365ba1bad2cf37.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab330d62f802a2573ccc6dce655a84bea7c54fa7002c94e7a0365ba1bad2cf37.xls
Resource
win10v2004-20221111-en
General
-
Target
ab330d62f802a2573ccc6dce655a84bea7c54fa7002c94e7a0365ba1bad2cf37.xls
-
Size
4.8MB
-
MD5
5a85f0bd825cbc17e91cf394238c308b
-
SHA1
57d67e78831df40f665b585ece367dea034d8a02
-
SHA256
ab330d62f802a2573ccc6dce655a84bea7c54fa7002c94e7a0365ba1bad2cf37
-
SHA512
c6f79f019a180364fd2e219c3a872173642c79e974da4fc3741f58ebfb1094ab15c365dfbdb2bcea7eff78ec2b6bbb32eb30cbfae3218d01bf84ccdb2e33295b
-
SSDEEP
98304:Jv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX7:JvpvFa+g8RWLdPk/84tCEr0RtNiC5eSe
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4304 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4304 EXCEL.EXE 4304 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
EXCEL.EXEpid process 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE 4304 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ab330d62f802a2573ccc6dce655a84bea7c54fa7002c94e7a0365ba1bad2cf37.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4304-132-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB
-
memory/4304-133-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB
-
memory/4304-134-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB
-
memory/4304-135-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB
-
memory/4304-136-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB
-
memory/4304-137-0x00007FFBB2450000-0x00007FFBB2460000-memory.dmpFilesize
64KB
-
memory/4304-138-0x00007FFBB2450000-0x00007FFBB2460000-memory.dmpFilesize
64KB
-
memory/4304-139-0x000001CFAAD30000-0x000001CFAAD34000-memory.dmpFilesize
16KB
-
memory/4304-140-0x000001CFAF7E0000-0x000001CFAF7E2000-memory.dmpFilesize
8KB
-
memory/4304-141-0x000001CFAF7EE000-0x000001CFAF7F0000-memory.dmpFilesize
8KB
-
memory/4304-142-0x000001CFAF7F5000-0x000001CFAF7F7000-memory.dmpFilesize
8KB
-
memory/4304-143-0x000001CFAA1F2000-0x000001CFAA1F4000-memory.dmpFilesize
8KB
-
memory/4304-145-0x000001CFA9E01000-0x000001CFA9E03000-memory.dmpFilesize
8KB
-
memory/4304-144-0x000001CFAF742000-0x000001CFAF744000-memory.dmpFilesize
8KB
-
memory/4304-146-0x000001CFAF731000-0x000001CFAF733000-memory.dmpFilesize
8KB
-
memory/4304-148-0x000001CFA9E01000-0x000001CFA9E03000-memory.dmpFilesize
8KB
-
memory/4304-149-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB
-
memory/4304-150-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB
-
memory/4304-151-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB
-
memory/4304-152-0x00007FFBB44B0000-0x00007FFBB44C0000-memory.dmpFilesize
64KB