Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2023, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
Pedido- 1253-360.xls
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Pedido- 1253-360.xls
Resource
win10v2004-20230703-en
General
-
Target
Pedido- 1253-360.xls
-
Size
1.4MB
-
MD5
3aaea611bbf04af88f795927bca16b9d
-
SHA1
74084df258e08f86c5c8d62abc51b14649fd8660
-
SHA256
ebd76ed616fef2f1a27deb6f252ffe2d62ab99bc90189d72e99f95fbf737200d
-
SHA512
584b38eb5ef6572569c20b6d99f50ddc4d4aa8f07e03ab9b4e73e0467d336875b06b74b00af3066d32caf411405534de2dc71581ee4058468cb5b1123f4ddafe
-
SSDEEP
24576:Mu9VTtZyxw6V4OZyCw6VxeHBlEzp7uTeRbgcwFA5DATMHYwV6x:MubXh6V4Y+6VIhOzJgjF9TSYz
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1748 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1748 EXCEL.EXE 1748 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Pedido- 1253-360.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5d69c22a341e111feea69df6d8c655d60
SHA1ac862337f2efa43627508927f5052ce694012206
SHA25605b2053bf1d070d6034b45cd79b54d80da3c6d88d016671a345e75048b1a68db
SHA512d4db33ed046b3c9ba09c4b3feac17b1fe2e75fce67f4154fd795d504708c295a1e3c8331ed3d6c3ee9950c936c4cc25b5d690558c26f2e1f7771bd5eb275822c