Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 09:41
Behavioral task
behavioral1
Sample
e-Ticket 확ì¸ì¦_95292914.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e-Ticket 확ì¸ì¦_95292914.xls
Resource
win10v2004-20230220-en
General
-
Target
e-Ticket 확ì¸ì¦_95292914.xls
-
Size
161KB
-
MD5
7928e36c8a45f98d5adf2016740b77eb
-
SHA1
ba2ba74fc339f2bb9232b89c57ddd2b7ac597dfb
-
SHA256
6a30c5ac83594b05a5cf418850afb4ae088f58517319cd8f70ef348bf7934708
-
SHA512
7fe2f98df87baaa89dae47ac663f59df507898fced550c1ea3306cb712843a14fb25774726ead5fa0d00ab4611763e26de2d0710032b9f11c3260aaf198d3521
-
SSDEEP
3072:gdvxHlcaAy0iWYOcG4BDhnxDV8ixGKpb8rGYrMPelwhKmFV5xtezEsg8/dgTVb8O:gdvxHlcaAy0iWYOcG4BDhnxDV8ixGKpL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1432 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE 1432 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e-Ticket 확ì¸ì¦_95292914.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1432-133-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB
-
memory/1432-134-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB
-
memory/1432-135-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB
-
memory/1432-136-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB
-
memory/1432-137-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB
-
memory/1432-138-0x00007FFA3BD50000-0x00007FFA3BD60000-memory.dmpFilesize
64KB
-
memory/1432-139-0x00007FFA3BD50000-0x00007FFA3BD60000-memory.dmpFilesize
64KB
-
memory/1432-191-0x000001427BD50000-0x000001427BF50000-memory.dmpFilesize
2.0MB
-
memory/1432-206-0x000001427BD50000-0x000001427BF50000-memory.dmpFilesize
2.0MB
-
memory/1432-217-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB
-
memory/1432-218-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB
-
memory/1432-219-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB
-
memory/1432-220-0x00007FFA3E110000-0x00007FFA3E120000-memory.dmpFilesize
64KB