Overview
overview
8Static
static
81010BSD.xls
windows7-x64
11010BSD.xls
windows10-2004-x64
11010BSS.xls
windows7-x64
11010BSS.xls
windows10-2004-x64
11010PLD.xls
windows7-x64
11010PLD.xls
windows10-2004-x64
11010PLS.xls
windows7-x64
11010PLS.xls
windows10-2004-x64
11011BSD.xls
windows7-x64
11011BSD.xls
windows10-2004-x64
11011BSS.xls
windows7-x64
11011BSS.xls
windows10-2004-x64
11011PLD.xls
windows7-x64
11011PLD.xls
windows10-2004-x64
11011PLS.xls
windows7-x64
11011PLS.xls
windows10-2004-x64
11012BSD.xls
windows7-x64
11012BSD.xls
windows10-2004-x64
11012BSS.xls
windows7-x64
11012BSS.xls
windows10-2004-x64
11012PLD.xls
windows7-x64
11012PLD.xls
windows10-2004-x64
11012PLS.xls
windows7-x64
11012PLS.xls
windows10-2004-x64
110Q4BSD.xls
windows7-x64
110Q4BSD.xls
windows10-2004-x64
110Q4PLD.xls
windows7-x64
110Q4PLD.xls
windows10-2004-x64
110Q4PLS.xls
windows7-x64
110Q4PLS.xls
windows10-2004-x64
1Budget Pro...Q4.xls
windows7-x64
1Budget Pro...Q4.xls
windows10-2004-x64
1Analysis
-
max time kernel
233s -
max time network
265s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2023 14:32
Behavioral task
behavioral1
Sample
1010BSD.xls
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1010BSD.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
1010BSS.xls
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
1010BSS.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
1010PLD.xls
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
1010PLD.xls
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
1010PLS.xls
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
1010PLS.xls
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
1011BSD.xls
Resource
win7-20231025-en
Behavioral task
behavioral10
Sample
1011BSD.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
1011BSS.xls
Resource
win7-20231025-en
Behavioral task
behavioral12
Sample
1011BSS.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
1011PLD.xls
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
1011PLD.xls
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
1011PLS.xls
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
1011PLS.xls
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
1012BSD.xls
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
1012BSD.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
1012BSS.xls
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
1012BSS.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
1012PLD.xls
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
1012PLD.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
1012PLS.xls
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
1012PLS.xls
Resource
win10v2004-20231020-en
Behavioral task
behavioral25
Sample
10Q4BSD.xls
Resource
win7-20231020-en
Behavioral task
behavioral26
Sample
10Q4BSD.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral27
Sample
10Q4PLD.xls
Resource
win7-20231020-en
Behavioral task
behavioral28
Sample
10Q4PLD.xls
Resource
win10v2004-20231023-en
Behavioral task
behavioral29
Sample
10Q4PLS.xls
Resource
win7-20231020-en
Behavioral task
behavioral30
Sample
10Q4PLS.xls
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
Budget Progress Report 10Q4.xls
Resource
win7-20231025-en
Behavioral task
behavioral32
Sample
Budget Progress Report 10Q4.xls
Resource
win10v2004-20231023-en
General
-
Target
1012BSS.xls
-
Size
18KB
-
MD5
626b255ca225bf2af5005549d56a433b
-
SHA1
a15d46628c2c1e6beca1415c811da1249c9c27be
-
SHA256
05bde1bd261914a1da4f9613d3d4051018595041a8615f487782d54d12474728
-
SHA512
6c5558789a42a2f39e9103c4cefb2241c8b1896db52de4b28af0415c92ac1d0af33c086194c3fd43c699eaa7fab5e47fcfd25049a6015b3d06fb6fcf7ebf4009
-
SSDEEP
192:9SdxB43AgdLSUX9umfdkLaoGaFmGvFNMWe9s9Be3Mqug7r7uNyf/H/nq:40YmfdkLaoG8rhuuNyfvC
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4400 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE 4400 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1012BSS.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4400