Analysis
-
max time kernel
100s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 05:30
Static task
static1
Behavioral task
behavioral1
Sample
6eb32e06855c07560bfb676e62a024be2b5842dbd5c23df14c56e329cc58fc53.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6eb32e06855c07560bfb676e62a024be2b5842dbd5c23df14c56e329cc58fc53.xlsx
Resource
win10v2004-20240226-en
General
-
Target
6eb32e06855c07560bfb676e62a024be2b5842dbd5c23df14c56e329cc58fc53.xlsx
-
Size
55KB
-
MD5
34a8b9df46f5c5f4932ee6795f73ca46
-
SHA1
451e212b96980cb0295c27bfa99a3b552073efaf
-
SHA256
6eb32e06855c07560bfb676e62a024be2b5842dbd5c23df14c56e329cc58fc53
-
SHA512
dda5cf523baeeb050526bf4f6b74fef7156c0768bf34e7bf46ee0c412dc2fa05abc8ac1b456ee3e752480fe94d7434a6e6aef329eda6fa43969e1d08d0663952
-
SSDEEP
1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehT:BoOAcw7nXDUsOjm3jTxhT
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3680 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE 3680 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6eb32e06855c07560bfb676e62a024be2b5842dbd5c23df14c56e329cc58fc53.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3680