Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 08:50
Behavioral task
behavioral1
Sample
1933b1bf1500c1abcfb68c6d5f888aca.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1933b1bf1500c1abcfb68c6d5f888aca.xls
Resource
win10v2004-20230220-en
General
-
Target
1933b1bf1500c1abcfb68c6d5f888aca.xls
-
Size
131KB
-
MD5
1933b1bf1500c1abcfb68c6d5f888aca
-
SHA1
5c258c7925289f5fcfc31d91a815b9a8c2c67e39
-
SHA256
4ded8a95b11056d74d1aba61116ea2448f8a3fb0e6624e902bd38e55c37e4200
-
SHA512
69e325b9e6717fbd2e0b8eeda350417df9495edd9ced17896b2efd906156df5abf3b4933b3117a968702a023c9f5d0505b0dae3b553f3baf35c937d14cfd022d
-
SSDEEP
1536:kAivUOh8icqgnlqKsr3sY8L9/GNfGhtA:kAiMOrcqgnlqKiI+QS
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2044 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 2044 EXCEL.EXE 2044 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1933b1bf1500c1abcfb68c6d5f888aca.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VB9DBD.tmpFilesize
1KB
MD57d85916cc26c8a681bc112af9b8243f2
SHA15cf1f7e229058ae613708f84cb8e8551a2ebc50b
SHA256f35b56d654a55a6867b55f96ab14dcab2af243d5aea81ab3dc2189c6768b89c6
SHA512e20721bf94e9dff6a1395651a4101f8a56b61938185b698fd2860cc7f233ad29ff02c7106a94fb7316b043654247a778cceddadc687564706c3397edc03abe28
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
256B
MD5c6b1a5f0fabb13661274b6680a92fb51
SHA1fb4f7039b2ebec3cb4437d95d522525294cadccc
SHA2563187033c928e0b968eba0b2ade93ae172fe40093bb6f99ac4b3f8a0d5fd506d1
SHA51225138c9e45282406b41ed01d2dc97da4be0db6cb254b8bac28244990065264390c6514d163f95e32993d91d9c77366de8de26440f51ac873da7ac97feff0d221
-
memory/2044-139-0x00007FFF25A10000-0x00007FFF25A20000-memory.dmpFilesize
64KB
-
memory/2044-136-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB
-
memory/2044-137-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB
-
memory/2044-138-0x00007FFF25A10000-0x00007FFF25A20000-memory.dmpFilesize
64KB
-
memory/2044-133-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB
-
memory/2044-134-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB
-
memory/2044-135-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB
-
memory/2044-198-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB
-
memory/2044-199-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB
-
memory/2044-200-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB
-
memory/2044-201-0x00007FFF27F30000-0x00007FFF27F40000-memory.dmpFilesize
64KB