Analysis
-
max time kernel
102s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2023 22:46
Behavioral task
behavioral1
Sample
www.xelplus.com_wp-content_uploads_2019_05_excel_vba_activex_listbox_printout.xlsm
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
www.xelplus.com_wp-content_uploads_2019_05_excel_vba_activex_listbox_printout.xlsm
Resource
win10v2004-20230220-en
General
-
Target
www.xelplus.com_wp-content_uploads_2019_05_excel_vba_activex_listbox_printout.xlsm
-
Size
80KB
-
MD5
cc1dc685f579bb63331fcdd3066f41ac
-
SHA1
dfcd196c4f824852b4cc776ef7547cd9322b1305
-
SHA256
1304611d58e846c528bb72af0301bd22fd2bf3bb6377b024bf88111aa8007872
-
SHA512
a54084355f161329e46412a9c9d32497bbca803f06a37a0b162e8636195e6a8dd8ec52bc22ff7b3464b11f8702a7528b0e0fda814a8da095ed8e8b2b50f58746
-
SSDEEP
1536:DOzWlwvHix8GN+QrpF/M2pwE7+VmUjaJkV2o+hS:6yUiRpM2pRMmUjiks2
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2692 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2692 wrote to memory of 3788 2692 EXCEL.EXE splwow64.exe PID 2692 wrote to memory of 3788 2692 EXCEL.EXE splwow64.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\www.xelplus.com_wp-content_uploads_2019_05_excel_vba_activex_listbox_printout.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2692-133-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB
-
memory/2692-134-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB
-
memory/2692-135-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB
-
memory/2692-136-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB
-
memory/2692-137-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB
-
memory/2692-138-0x00007FFE775C0000-0x00007FFE775D0000-memory.dmpFilesize
64KB
-
memory/2692-139-0x00007FFE775C0000-0x00007FFE775D0000-memory.dmpFilesize
64KB
-
memory/2692-153-0x00000161E9ED0000-0x00000161EA0D0000-memory.dmpFilesize
2.0MB
-
memory/2692-161-0x00000161E9ED0000-0x00000161EA0D0000-memory.dmpFilesize
2.0MB
-
memory/2692-176-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB
-
memory/2692-177-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB
-
memory/2692-178-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB
-
memory/2692-179-0x00007FFE79BB0000-0x00007FFE79BC0000-memory.dmpFilesize
64KB