38a5d5432a654e4196c8c8bb73cfa5f85f9dd57c86a9229472787ee3165e75f7

Resubmissions

18-09-2023 19:48

230918-yjcc1aef87 10

18-09-2023 19:44

230918-yfxvjaef77 1

Analysis

max time kernel
300s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2023 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38a5d5432a654e4196c8c8bb73cfa5f85f9dd57c86a9229472787ee3165e75f7.xls
Size

134KB
MD5

f62c20fa55c5cd1113e6388ddd6982c0
SHA1

7d3ecaaf149d049056bb1baef3e10649940097bc
SHA256

38a5d5432a654e4196c8c8bb73cfa5f85f9dd57c86a9229472787ee3165e75f7
SHA512

986a1cee21e348fc1323373717968eac2f44201dea9cb87be22a285f1a3a3f4418e130f34de6d3e83761375085388ac8d7ae1ef59aecbff9962e3f42385f5053
SSDEEP

3072:oClOWUjWjf446h9jk5vw7SAEt4Ldq3xktQ73:oClOWUjWjf446h9jk5vw7SAEt4Ldq3xh

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2856	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2856	EXCEL.EXE
2856	EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE
2856	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\38a5d5432a654e4196c8c8bb73cfa5f85f9dd57c86a9229472787ee3165e75f7.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2856-0-0x00007FFE42A90000-0x00007FFE42AA0000-memory.dmp

Filesize
64KB

Download
memory/2856-1-0x00007FFE42A90000-0x00007FFE42AA0000-memory.dmp

Filesize
64KB

Download
memory/2856-3-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-2-0x00007FFE42A90000-0x00007FFE42AA0000-memory.dmp

Filesize
64KB

Download
memory/2856-5-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-4-0x00007FFE42A90000-0x00007FFE42AA0000-memory.dmp

Filesize
64KB

Download
memory/2856-7-0x00007FFE42A90000-0x00007FFE42AA0000-memory.dmp

Filesize
64KB

Download
memory/2856-8-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-6-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-9-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-10-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-11-0x00007FFE404D0000-0x00007FFE404E0000-memory.dmp

Filesize
64KB

Download
memory/2856-12-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-13-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-15-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-16-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-17-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-18-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-14-0x00007FFE404D0000-0x00007FFE404E0000-memory.dmp

Filesize
64KB

Download
memory/2856-19-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-21-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-22-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-23-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-20-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-25-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-26-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download
memory/2856-27-0x00007FFE82A10000-0x00007FFE82C05000-memory.dmp

Filesize
2.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads