Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 08:50
Behavioral task
behavioral1
Sample
8ab8b3d9e10e52b04488159127f4ee60.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8ab8b3d9e10e52b04488159127f4ee60.xls
Resource
win10v2004-20230220-en
General
-
Target
8ab8b3d9e10e52b04488159127f4ee60.xls
-
Size
131KB
-
MD5
8ab8b3d9e10e52b04488159127f4ee60
-
SHA1
0caf132b0f22fb95c7c262d9633f5a2c4b42c6f2
-
SHA256
4b710a2ad6916a4e9516b127499a35db3f84ce11e4917a9fb8be3798bf521c63
-
SHA512
e238b93f4a63adc3820df2d8cc714984168c2e9cd3e9f7be07ce1670120329a5cf7b0152fba87604ac1d23172cececab4bf1672f781dfd6c2016089f2b8f1a6d
-
SSDEEP
1536:iAivUOh8icqgnlqKsr3sY8L9/GNfGhtA:iAiMOrcqgnlqKiI+QS
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3448 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 3448 EXCEL.EXE 3448 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8ab8b3d9e10e52b04488159127f4ee60.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VB8D32.tmpFilesize
1KB
MD57d85916cc26c8a681bc112af9b8243f2
SHA15cf1f7e229058ae613708f84cb8e8551a2ebc50b
SHA256f35b56d654a55a6867b55f96ab14dcab2af243d5aea81ab3dc2189c6768b89c6
SHA512e20721bf94e9dff6a1395651a4101f8a56b61938185b698fd2860cc7f233ad29ff02c7106a94fb7316b043654247a778cceddadc687564706c3397edc03abe28
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
256B
MD5c6b1a5f0fabb13661274b6680a92fb51
SHA1fb4f7039b2ebec3cb4437d95d522525294cadccc
SHA2563187033c928e0b968eba0b2ade93ae172fe40093bb6f99ac4b3f8a0d5fd506d1
SHA51225138c9e45282406b41ed01d2dc97da4be0db6cb254b8bac28244990065264390c6514d163f95e32993d91d9c77366de8de26440f51ac873da7ac97feff0d221
-
memory/3448-139-0x00007FFDDAFA0000-0x00007FFDDAFB0000-memory.dmpFilesize
64KB
-
memory/3448-136-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB
-
memory/3448-137-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB
-
memory/3448-138-0x00007FFDDAFA0000-0x00007FFDDAFB0000-memory.dmpFilesize
64KB
-
memory/3448-133-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB
-
memory/3448-135-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB
-
memory/3448-134-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB
-
memory/3448-198-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB
-
memory/3448-199-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB
-
memory/3448-200-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB
-
memory/3448-201-0x00007FFDDD8B0000-0x00007FFDDD8C0000-memory.dmpFilesize
64KB