Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
2cfed0316322878057c356309b8e0640c0f0f3b4f2b19231f642c2df6d7189b6.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2cfed0316322878057c356309b8e0640c0f0f3b4f2b19231f642c2df6d7189b6.xlsx
Resource
win10v2004-20240226-en
General
-
Target
2cfed0316322878057c356309b8e0640c0f0f3b4f2b19231f642c2df6d7189b6.xlsx
-
Size
22KB
-
MD5
16aaa64f543ea8cfc42c9608ddd9031a
-
SHA1
372f46a1870b68053873d86ade543b8a5a287690
-
SHA256
2cfed0316322878057c356309b8e0640c0f0f3b4f2b19231f642c2df6d7189b6
-
SHA512
574d3a6405e34fc6e9a1e9576903846f6c509b18edb7f5c9a8cd80ecf723272ccb71a12fc836cf5f94f93582f9c56db46fc20999e0f9ec4711f6663db121cdda
-
SSDEEP
384:1av11gejss+1Hit2/S/KtyG6nT7RiB61l8f/dv9A8ehRCA:AvvgKf+1HitCteTA61+X88ehRCA
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3772 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE 3772 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2cfed0316322878057c356309b8e0640c0f0f3b4f2b19231f642c2df6d7189b6.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3772