2234e3fe02b513ca6117481b73aa56552baff9ef2b7d2e06c95df3ec8acd8d40

General

Target

安全检查资产上报收集表-20231103/安全检查资产上报收集表-20231103.xlsx
Size

11KB
MD5

bcb7844128b94a56fdd1a507b4ce6382
SHA1

d6d168e1ded6d41bec1902b3b9af04d3a2f76b3a
SHA256

6d81b7976a2dfa69d0136c803ce732522fa5cbed1ae337851d9d7ae0f7ec6472
SHA512

d1f812dfdfe943f6dbf8f2c8e931fb1488156a8f8002e2cd3d63f2105cf51fcbe3c9cfb86749929cd904bbbedbf1550d4b7955ef50c9bf7aedc253fa0cea66ae
SSDEEP

192:t9AJ+cpbTjDOeu0pvvgaltjjC4jjWykU1TEAbjD8Q19xfzUYjwJkk4ZCy:t+J+coeu0pvvgavj/jWykoJ1sqPku

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

404 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

404 EXCEL.EXE
404 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE
404	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\安全检查资产上报收集表-20231103\安全检查资产上报收集表-20231103.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/404-0-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-1-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-3-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-2-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-4-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-6-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-7-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-5-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-8-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-9-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-10-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-12-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-13-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-11-0x00007FFF7A740000-0x00007FFF7A750000-memory.dmp

Filesize
64KB

Download
memory/404-14-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-15-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-17-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-16-0x00007FFF7A740000-0x00007FFF7A750000-memory.dmp

Filesize
64KB

Download
memory/404-18-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-19-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-20-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-21-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-22-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-23-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-33-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-34-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-43-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-45-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-46-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-44-0x00007FFF7CDD0000-0x00007FFF7CDE0000-memory.dmp

Filesize
64KB

Download
memory/404-47-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-48-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-49-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download
memory/404-50-0x00007FFFBCD50000-0x00007FFFBCF45000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads