Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2023 12:53
Static task
static1
Behavioral task
behavioral1
Sample
NL22INGB0655496718_20221022_20231022.csv
Resource
win10v2004-20231020-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
NL22INGB0655496718_20221022_20231022.csv
-
Size
22KB
-
MD5
bdf7cea2e4194955dc2b46f96710ee60
-
SHA1
0b579b6701025f71e97985c11957da4c7dee2b32
-
SHA256
a2609a9c9d915ede9ce694acb7a691e8bceaf5f48f5696ac7dd5c3ffb8876c6d
-
SHA512
3e86d2d90075e60a04511e67d72da8c835b797f0c486e990fbcdacef613f25f20c0cf4bdad76a8a726ccafe4c904f5acd72df15e1207837263f17aa42778be02
-
SSDEEP
384:LIVzIsn7QOYRdiFU+tX6ROcI+tfgXqmJqbXcjXGJt:QhCm6+y
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3464 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\NL22INGB0655496718_20221022_20231022.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3464