Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2023 08:37
Behavioral task
behavioral1
Sample
K9000457.xls
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
K9000457.xls
Resource
win10v2004-20230703-en
General
-
Target
K9000457.xls
-
Size
160KB
-
MD5
95ec322adb11464f4965658daf6933dc
-
SHA1
73da6a3cdd8a1f0faff0e077c1a502130dd082a8
-
SHA256
faa80735addb3c128a7e13e53fc703995ef41df93275e9ed3c592615d4ed0050
-
SHA512
3632214c8cc2296aa49a9deff854a453cb832ffd4dea4fd88f6af40e01c0b226c8e86ebb8b69d3d318c01f53fd12f68a92f311706d53ab2d3de6d4950d1033e5
-
SSDEEP
3072:NxYLAYiRUBxm2UDvZSvfjCGnsOCLF+LR22tF0hjUOchulciZmYeUdMBANsPIxDky:HYLAYiRUBxm2UDvZSvfjC0sOCLF+LR2l
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1912 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1912 EXCEL.EXE 1912 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
EXCEL.EXEpid process 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE 1912 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\K9000457.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1912-133-0x00007FFD30210000-0x00007FFD30220000-memory.dmpFilesize
64KB
-
memory/1912-134-0x00007FFD30210000-0x00007FFD30220000-memory.dmpFilesize
64KB
-
memory/1912-135-0x00007FFD30210000-0x00007FFD30220000-memory.dmpFilesize
64KB
-
memory/1912-136-0x00007FFD30210000-0x00007FFD30220000-memory.dmpFilesize
64KB
-
memory/1912-137-0x00007FFD30210000-0x00007FFD30220000-memory.dmpFilesize
64KB
-
memory/1912-138-0x00007FFD2DC70000-0x00007FFD2DC80000-memory.dmpFilesize
64KB
-
memory/1912-139-0x00007FFD2DC70000-0x00007FFD2DC80000-memory.dmpFilesize
64KB
-
memory/1912-144-0x000001A379BC0000-0x000001A379DC0000-memory.dmpFilesize
2.0MB
-
memory/1912-157-0x000001A379BC0000-0x000001A379DC0000-memory.dmpFilesize
2.0MB