82c532dbbc2c2d43b993f06471a35d6d25bf8b95b1784fabac3b0f50f728d479

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2023, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f38ad97265f312101b15710f97bd2b72.xls
Size

8.3MB
MD5

f38ad97265f312101b15710f97bd2b72
SHA1

716fa7033fb8e91ae67d181df06074c132b78672
SHA256

82c532dbbc2c2d43b993f06471a35d6d25bf8b95b1784fabac3b0f50f728d479
SHA512

4757ff1ff56bcbcbe01dcabb5a0fb817e04a54274860319d1162a86bfe85c1c9365cc4b1931176c79f8c7ca94343f48e70e7b63b4ac31d8d2cbec0b1e9e6ec14
SSDEEP

49152:kFepJPBVlYeshgqP8CJR4eecZisnqR9+gv1GfJQlCgOnbXD4nytjbYbgu0LcSASe:86JPBV2f8eIAHzY1MQBSXIytjEgIyYP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4896	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4896	EXCEL.EXE
4896	EXCEL.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE
4896	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f38ad97265f312101b15710f97bd2b72.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BRC\currentbuilds.brc

Filesize
238B

MD5
66c4dafa9ca57dc3b370b0bbfdecf670

SHA1
55e9a640a32ad8c720aa268288e3f33d38045c01

SHA256
f5a5a7808cefd19172ec97574d04937692ee72555e58f4d3079c1888bb1bba52

SHA512
192051601e9778937f2a2cdca6a6daa212e0439c562072ef420800fa9ee3407ec728bcfcf1175d621bb6931d42fdb2c4e98abbaceec33959f40e492835360472

Download Submit
C:\Users\Admin\AppData\Local\Temp\BRC\glbllicadj.brc

Filesize
13KB

MD5
cfa6695a93d85104922e602ab36d7d2b

SHA1
3138c1231f112c5a8de22f175fb9338ea67ce0be

SHA256
d4a2fd54510a5f3051bec0ef2087176d6e0f271cefaff3a193b919bf185088ef

SHA512
3057b08978d21318d7211150d119538d52f8de7ba9b0fef2a835e9060a64e7a55ef841c7d0e9bd07d5909baedb66f908393baf2660c389a3ace8a7249ce774eb

Download Submit
memory/4896-133-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp

Filesize
64KB

Download
memory/4896-134-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp

Filesize
64KB

Download
memory/4896-135-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp

Filesize
64KB

Download
memory/4896-136-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp

Filesize
64KB

Download
memory/4896-137-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp

Filesize
64KB

Download
memory/4896-138-0x00007FF840A10000-0x00007FF840A20000-memory.dmp

Filesize
64KB

Download
memory/4896-139-0x00007FF840A10000-0x00007FF840A20000-memory.dmp

Filesize
64KB

Download
memory/4896-150-0x0000019CBE4A0000-0x0000019CBE6A0000-memory.dmp

Filesize
2.0MB

Download
memory/4896-207-0x0000019CB97D0000-0x0000019CB9A2F000-memory.dmp

Filesize
2.4MB

Download
memory/4896-274-0x0000019CBE4A0000-0x0000019CBE6A0000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads