Analysis
-
max time kernel
104s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2023, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
PO_23509-23510.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PO_23509-23510.xls
Resource
win10v2004-20230220-en
General
-
Target
PO_23509-23510.xls
-
Size
1.0MB
-
MD5
3ff60872925b136a4a02f9646b605df3
-
SHA1
9d2eec41446241b5dd654fad00062b92b0e8f340
-
SHA256
64832b9f03d64470940e7481e9adfb6fa728d8a822cc7c649f8e32eafa18125b
-
SHA512
9d6890cf25cdd1a67edffff1c4ee6605160e24aa8a3fb76a0add988f7fc2b8caa61b2062e333310eef0e1fc358af734974b1badd5072171dd4074048579c1388
-
SSDEEP
24576:jLKnSSMMednEoakAmmjmRakAmmjmu+MXUkfOt2222222222222222222222K27P:jLKRMLaaoeaao9+MXiB
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4132 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4132 EXCEL.EXE 4132 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE 4132 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO_23509-23510.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4132
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD55c65827565e89d5357d6f81294701c19
SHA1600aa1899bdc58d12671774e84033366dc931c04
SHA256dec6f35ceb48260f3ba4e6487c48d3f97b274f2eff29cab00c2c7e677eef4b4f
SHA512052c177c606d30f4f3b658f60bb3643fffec498cc8fa931b4380aa6b93ac20fa9ef4600645740e99ba2f6d43e333fe783378d14395132819d6fb44787aad196a