Overview
overview
10Static
static
81c1f3eaf14...47.doc
windows7-x64
41c1f3eaf14...47.doc
windows10-2004-x64
1023e8349880...94.doc
windows7-x64
423e8349880...94.doc
windows10-2004-x64
15568d72be1...f.xlsm
windows7-x64
15568d72be1...f.xlsm
windows10-2004-x64
1b8eedd0138...3.docm
windows7-x64
10b8eedd0138...3.docm
windows10-2004-x64
10bcdf20e654...7.docm
windows7-x64
10bcdf20e654...7.docm
windows10-2004-x64
10c82717259c...2.docm
windows7-x64
10c82717259c...2.docm
windows10-2004-x64
10Analysis
-
max time kernel
106s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2023 10:17
Behavioral task
behavioral1
Sample
1c1f3eaf142c53480147c6e98cea4547.doc
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1c1f3eaf142c53480147c6e98cea4547.doc
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
23e8349880dde570473345c8b6ba8d94.doc
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
23e8349880dde570473345c8b6ba8d94.doc
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
5568d72be1bdebf9187261a24b3b324f.xlsm
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
5568d72be1bdebf9187261a24b3b324f.xlsm
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
b8eedd013827b960eee4c0ae07ae5513.docm
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
b8eedd013827b960eee4c0ae07ae5513.docm
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
bcdf20e65445ed6bda794d958025e417.docm
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
bcdf20e65445ed6bda794d958025e417.docm
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
c82717259c368b69cb64572e74042c02.docm
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
c82717259c368b69cb64572e74042c02.docm
Resource
win10v2004-20230221-en
General
-
Target
5568d72be1bdebf9187261a24b3b324f.xlsm
-
Size
22KB
-
MD5
5568d72be1bdebf9187261a24b3b324f
-
SHA1
3729b13695a975366e1604e4fe31226591793823
-
SHA256
2d9d77b0ab2b6c17fb16a1ce244f5d26fe9e688f6d7ee071fef18bee8e510737
-
SHA512
a9befbe909487c68dd0d074066d3731db71985242fcb91a044f2410114372266b117b04ff71a51374f5cbda9842c2489197aebc3df102562e48eb408fe7f4389
-
SSDEEP
384:oVzIiSXPf8dizrcdDbUVOwGAnbmbAecFekbKWVmNrxQ8khE1pE/a:G8iDiEdDgxmADekbKW8rky1p3
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2488 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 2488 EXCEL.EXE 2488 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE 2488 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5568d72be1bdebf9187261a24b3b324f.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BF47C1AD.tmpFilesize
1KB
MD59d1feadd38cdc831863c5388489588f7
SHA11717fa864fc5cc2787f78cb8f0a26a2321a62a52
SHA256bac7e111d39f42ad81122ae459926d4772ffa6b7b7db03df83acdf3082b7a558
SHA5122f2cb90da830ecdb83454c00603ff8c0cc59a3410843b44e2cb4ad914a83104f2d69c6ee7d425823fa8286d239ad64f8b9d4f6ab15256f262d157dcd2ebd893b
-
memory/2488-133-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB
-
memory/2488-134-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB
-
memory/2488-135-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB
-
memory/2488-136-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB
-
memory/2488-137-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB
-
memory/2488-138-0x00007FFB14960000-0x00007FFB14970000-memory.dmpFilesize
64KB
-
memory/2488-139-0x00007FFB14960000-0x00007FFB14970000-memory.dmpFilesize
64KB
-
memory/2488-181-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB
-
memory/2488-182-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB
-
memory/2488-183-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB
-
memory/2488-184-0x00007FFB16D90000-0x00007FFB16DA0000-memory.dmpFilesize
64KB