Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757cxls_JC.xls
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757cxls_JC.xls
Resource
win10v2004-20231023-en
General
-
Target
NEAS.1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757cxls_JC.xls
-
Size
1.5MB
-
MD5
71368866925c23e35d340705fae95002
-
SHA1
8b2e76a61f33f053eb4fc2f2bc3600917e7d1d09
-
SHA256
1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757c
-
SHA512
6bddbc8a6824bf2d7137042b762da78d8c02e6756f488003a8d142cc7b111720710f4f31034e8d9c1dca33847ac822a9ed81d2e97f647d0708ddb5db271461f6
-
SSDEEP
24576:cWQmmav30xrmZy3w6VA3bVNRFZyVw6VC3bVG4nvsLtbtecTQ5WWkK3q/0wkex:xQmmQ309wP6VA3bVDN6VC3bV25tBTTKg
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3728 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3728 EXCEL.EXE 3728 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE 3728 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\NEAS.1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757cxls_JC.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5d69c22a341e111feea69df6d8c655d60
SHA1ac862337f2efa43627508927f5052ce694012206
SHA25605b2053bf1d070d6034b45cd79b54d80da3c6d88d016671a345e75048b1a68db
SHA512d4db33ed046b3c9ba09c4b3feac17b1fe2e75fce67f4154fd795d504708c295a1e3c8331ed3d6c3ee9950c936c4cc25b5d690558c26f2e1f7771bd5eb275822c