78db3edeb45a9848b0f4b9311565310ea938332125763a6338e6207eaed69eeb

Analysis

max time kernel
119s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0403 Packing List.xls
Size

1.5MB
MD5

93f959f812ca137d8ddea1039fc0130e
SHA1

9ef73bbd3144ac67acc01b2173449613a476b9ac
SHA256

78db3edeb45a9848b0f4b9311565310ea938332125763a6338e6207eaed69eeb
SHA512

79a80f2de1eb4c88114eddd48013f2985cef01fc6d9ad4b97890d1b7bc7d5912ec9a39d1feb4b3cd0a138315d8da973c40131014fb6c17b2cbc3bc648c7df140
SSDEEP

24576:BLKuZyWZWZyibF3ZZyFWT+JWT+cZyAL0OZy87gRZy6xsRQKRcATQB6qvKN:BLK4yNPxB/m9CRjTTFN

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2396 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

2396 EXCEL.EXE
2396 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE
2396	EXCEL.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0403 Packing List.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B365C53B.emf
Filesize
95KB

MD5
3faf5b0096f65d1ce65fb3114dec4f0c

SHA1
e829d253b20667c2bafae93ca1b986fd46590aa2

SHA256
31e586b9894e034f731b0c2eeca358ced69dd25af1c5b35078560838cd306d62

SHA512
05f345ad5984312d1313f56462165d6f4170cae47add7cd084d8cc1f184425c77a722d6efe110aa9446a744245d1ae53da371908fccd070d494d74840c99a6dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EB838600.emf
Filesize
1.4MB

MD5
a01b9617553432807b9b58025b338d97

SHA1
439bdcc450408b9735b2428c2d53d2e6977fa58c

SHA256
7a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce

SHA512
312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee

Download Submit
memory/2396-139-0x00007FFB878D0000-0x00007FFB878E0000-memory.dmp

Filesize
64KB

Download
memory/2396-136-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download
memory/2396-137-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download
memory/2396-138-0x00007FFB878D0000-0x00007FFB878E0000-memory.dmp

Filesize
64KB

Download
memory/2396-133-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download
memory/2396-134-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download
memory/2396-135-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download
memory/2396-174-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download
memory/2396-175-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download
memory/2396-176-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download
memory/2396-177-0x00007FFB89930000-0x00007FFB89940000-memory.dmp

Filesize
64KB

Download