Analysis
-
max time kernel
147s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
14813c4b6f79f7bb19b05ce071a63c65.doc
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
14813c4b6f79f7bb19b05ce071a63c65.doc
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
decrypted.xlsx
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
decrypted.xlsx
Resource
win10v2004-20231215-en
General
-
Target
decrypted.xlsx
-
Size
583KB
-
MD5
819fa9bbd214effec31e7ee3e060cd36
-
SHA1
7bfb5d4ffd767bc58141a0fc75fc403c9de746d9
-
SHA256
14e84ec26421066444231207f0b412b3cf6aa1efdbeded80cd9cfe06ae89f9eb
-
SHA512
46870062994a086abb86b65f9e7d343114f41382be4f2bde1dd4218e3014c07e1f483c73becf53b32d4d03826fe5e7afafbb3599149e7244091b66d527f04c2b
-
SSDEEP
12288:B2jU1vyAtnucaEfAJoa+0zl/ZYTdwFu0OenxDzhCqwbRXbxZL:IjGbnlaEIJoa+D0Oe9knbnL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4548 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4548 EXCEL.EXE 4548 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE 4548 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\decrypted.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4548