Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 19:51
Static task
static1
Behavioral task
behavioral1
Sample
93f7cc7cbe37bd20991ebf0f5bab5f4a8bf44d59574a8fcce808f952e0db1c6c.xll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
93f7cc7cbe37bd20991ebf0f5bab5f4a8bf44d59574a8fcce808f952e0db1c6c.xll
Resource
win10v2004-20230220-en
General
-
Target
93f7cc7cbe37bd20991ebf0f5bab5f4a8bf44d59574a8fcce808f952e0db1c6c.xll
-
Size
589KB
-
MD5
ac44e14da94807ebfba7f66890228ab9
-
SHA1
bd2e9ce40ce5579bfb5fcf9261bb6723f392fc7a
-
SHA256
93f7cc7cbe37bd20991ebf0f5bab5f4a8bf44d59574a8fcce808f952e0db1c6c
-
SHA512
9a6bdbe96f4ab2421755ef9595faf588734a06637e337b75494b1b7fad05714f636c00a72e7f1dfd591c7f2fd386b5540bdcce8adb22308c798088fbaa0a61ca
-
SSDEEP
6144:8cTaT6oGCNIamrNSYVntMpONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fEpSIm3OdQwgvpVndf42HXDiuJTMw4
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4948 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
EXCEL.EXEpid process 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE 4948 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\93f7cc7cbe37bd20991ebf0f5bab5f4a8bf44d59574a8fcce808f952e0db1c6c.xll"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4948-133-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB
-
memory/4948-134-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB
-
memory/4948-135-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB
-
memory/4948-136-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB
-
memory/4948-137-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB
-
memory/4948-138-0x00007FFA07280000-0x00007FFA07290000-memory.dmpFilesize
64KB
-
memory/4948-139-0x00007FFA07280000-0x00007FFA07290000-memory.dmpFilesize
64KB
-
memory/4948-157-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB
-
memory/4948-158-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB
-
memory/4948-160-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB
-
memory/4948-159-0x00007FFA09910000-0x00007FFA09920000-memory.dmpFilesize
64KB