Analysis
-
max time kernel
101s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
14-02-2023 19:28
Behavioral task
behavioral1
Sample
35d6448bcc9403a834672312de9e42bb.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
35d6448bcc9403a834672312de9e42bb.xls
Resource
win10v2004-20221111-en
General
-
Target
35d6448bcc9403a834672312de9e42bb.xls
-
Size
340KB
-
MD5
35d6448bcc9403a834672312de9e42bb
-
SHA1
5e62633d185f5375658c475e89c99edd1366c098
-
SHA256
a71aa198b9a7042c3f1e12e1668dbc49af84a18fcb98a3df986dac5b278e3335
-
SHA512
421f477406fac753d005133002b17bb08580862fda7903ef966e21a00373c113d449ef134535e48aedb6b919e233db10d37cc1c16133c0c25439ca9e388591f2
-
SSDEEP
6144:WbRXRD2wK4OYwuIiImnF3JnlTrLnk3hOdsylKlgryzc4bNhZF+E+WYgWLLfas4bl:uLC5dQIqxR
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4180 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\35d6448bcc9403a834672312de9e42bb.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4180-132-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB
-
memory/4180-133-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB
-
memory/4180-134-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB
-
memory/4180-135-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB
-
memory/4180-136-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB
-
memory/4180-137-0x00007FF9FED70000-0x00007FF9FED80000-memory.dmpFilesize
64KB
-
memory/4180-138-0x00007FF9FED70000-0x00007FF9FED80000-memory.dmpFilesize
64KB
-
memory/4180-139-0x00000223781CA000-0x00000223781CC000-memory.dmpFilesize
8KB
-
memory/4180-140-0x00000223781CC000-0x00000223781CE000-memory.dmpFilesize
8KB
-
memory/4180-142-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB
-
memory/4180-143-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB
-
memory/4180-144-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB
-
memory/4180-145-0x00007FFA01630000-0x00007FFA01640000-memory.dmpFilesize
64KB