Analysis
-
max time kernel
101s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 08:54
Behavioral task
behavioral1
Sample
257e577a5ae85102db38ef684a57781f.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
257e577a5ae85102db38ef684a57781f.xls
Resource
win10v2004-20230220-en
General
-
Target
257e577a5ae85102db38ef684a57781f.xls
-
Size
191KB
-
MD5
257e577a5ae85102db38ef684a57781f
-
SHA1
33eaa995303ba2671951d03b6ff1b1ec971fd8d4
-
SHA256
e02cc68027680de90f7458d061ebf90b9012280e0ef216283e3abe95421c7c42
-
SHA512
4f42eb4ea59bb671622f2a34a2c60eccaf829b6215a60ca4e77e37203e81b44d857bdebd1b15dba3b992ad3a41e1b9d503ab274e19c392eb271e36419838fc7e
-
SSDEEP
3072:CrQ2xEtjPOtioVjDGUU1qfDlaGGx+cL2QjAYkJIlAD/XxHNl9/Bm9BZiRNOqW2N4:qxEtjPOtioVjDGUU1qfDlavx+W2QjA9
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1804 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1804 EXCEL.EXE 1804 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\257e577a5ae85102db38ef684a57781f.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VBA58D.tmpFilesize
1KB
MD5a950fcfb38c4bd2aed2ab8de725d0c4f
SHA193b21283abc042f7b21a78a4551e98a96bff73a3
SHA2565474b6db2ec8267733054de176aa0096e5d4a6e656dc9d8766c810528ac8b5c1
SHA5122ef190c0e1542bcec78f27719b42579fd0f5bb0b3c538c1e8ed3619266b018ba7185e3cf2c2b5a1b6b34cb217596f3e184a6116f418b7792d5d034dcb9915be4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
256B
MD5c6b1a5f0fabb13661274b6680a92fb51
SHA1fb4f7039b2ebec3cb4437d95d522525294cadccc
SHA2563187033c928e0b968eba0b2ade93ae172fe40093bb6f99ac4b3f8a0d5fd506d1
SHA51225138c9e45282406b41ed01d2dc97da4be0db6cb254b8bac28244990065264390c6514d163f95e32993d91d9c77366de8de26440f51ac873da7ac97feff0d221
-
memory/1804-139-0x00007FFDB9D10000-0x00007FFDB9D20000-memory.dmpFilesize
64KB
-
memory/1804-136-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB
-
memory/1804-137-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB
-
memory/1804-138-0x00007FFDB9D10000-0x00007FFDB9D20000-memory.dmpFilesize
64KB
-
memory/1804-133-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB
-
memory/1804-135-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB
-
memory/1804-134-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB
-
memory/1804-197-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB
-
memory/1804-198-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB
-
memory/1804-199-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB
-
memory/1804-200-0x00007FFDBBE70000-0x00007FFDBBE80000-memory.dmpFilesize
64KB