Analysis
-
max time kernel
147s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
bb0e3052629009363477c8fd04a9c41b.xlsm
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bb0e3052629009363477c8fd04a9c41b.xlsm
Resource
win10v2004-20240226-en
General
-
Target
bb0e3052629009363477c8fd04a9c41b.xlsm
-
Size
41KB
-
MD5
bb0e3052629009363477c8fd04a9c41b
-
SHA1
993ca515203ed775caeed919fd8bd7d9c32aabac
-
SHA256
784662f1fa2da6d62aa2a128c419b0ebeb1caa2a8224edf857bbc959697bae96
-
SHA512
7568387331ee1c296cec098ceaeb01eb7da7c24547cfad5f9dd86b81e56dea435ef191d0b0b991c2955587706afdbb3444aa6a3aed86822a63d293cee11158c3
-
SSDEEP
768:jh6ibfxq5rZN0DGCfkyX3eks4pSGn0Qic3qzQtKkxOc+Qzrj/QF/:16A6GzfPeUv02mQVUQzvC/
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1584 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE 1584 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bb0e3052629009363477c8fd04a9c41b.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1584