16f2ee60b9f965f35d60688fc7f2af5f3e028070a2bea61a9fb90a0905b6034c

Resubmissions

02/02/2023, 17:53

230202-wgjcesbe5t 1

02/02/2023, 00:21

230202-anerxsdf69 1

Analysis

max time kernel
101s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2023, 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Personal monthly budget1.xlsx
Size

40KB
MD5

b53b1bd8c5d13b78377a150c70d5476c
SHA1

6096c6f9b23ee66ab5b18b28be0c581cd15f7466
SHA256

efc30c2a151fc59178d5670525082d4aaf81e5fb4b175414b3427a2c3aad437f
SHA512

b882dc006183cc359975bdb3aa338c659cb9f4ceccf2249dadc563660f2f2e0b95caee943fa77ff8dc4c430b3818e739ddc8f9a1bb891e0bf2a46bac01f83d18
SSDEEP

768:ec2cloocpwH0VHXbF2Kay92O/qYXB9TMm2mgMIYwVw5Cuv8T1U:eRvxpu6HJ5hbTMmPTI1wh0S

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
760	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE
760	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Personal monthly budget1.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-132-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download
memory/760-133-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download
memory/760-134-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download
memory/760-135-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download
memory/760-136-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download
memory/760-137-0x00007FF9A9AC0000-0x00007FF9A9AD0000-memory.dmp

Filesize
64KB

Download
memory/760-138-0x00007FF9A9AC0000-0x00007FF9A9AD0000-memory.dmp

Filesize
64KB

Download
memory/760-140-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download
memory/760-141-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download
memory/760-142-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download
memory/760-143-0x00007FF9AC3F0000-0x00007FF9AC400000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads