Analysis
-
max time kernel
163s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2023, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
F6492AD0470B829459520B18427A41F67050E926656592DDB0EFFD892D57D0DB.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
F6492AD0470B829459520B18427A41F67050E926656592DDB0EFFD892D57D0DB.xls
Resource
win10v2004-20230220-en
General
-
Target
F6492AD0470B829459520B18427A41F67050E926656592DDB0EFFD892D57D0DB.xls
-
Size
287KB
-
MD5
c647ab911862f2b75ceb0d762334f055
-
SHA1
52fb85f679cd7fb96e742b3d47c719e0eca6eaed
-
SHA256
f6492ad0470b829459520b18427a41f67050e926656592ddb0effd892d57d0db
-
SHA512
b4e7cac3be8ceec113cfd19eb116a65c27517f0fd0bba15263186beb029d55ddc3b14aa1efcad73d485ef42944206efddbc3c9a602993c60e0d1b27bc0b50395
-
SSDEEP
3072:1kZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA:KZ+RwPONXoRjDhIcp0fDlavx+W26nA
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1292 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE 1292 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\F6492AD0470B829459520B18427A41F67050E926656592DDB0EFFD892D57D0DB.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1292