Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
VET Stmt.xlsx
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
VET Stmt.xlsx
Resource
win10v2004-20240226-en
5 signatures
150 seconds
General
-
Target
VET Stmt.xlsx
-
Size
1.0MB
-
MD5
d7942365eb52b673b42a478e7ed80cd8
-
SHA1
860d2f5ef1a3f295095aa07219d947c698f49bb2
-
SHA256
f04812d114275a3d87fca9c109e79e37f1a1f7c1b85d8630dfe8e5dfaf813db5
-
SHA512
e222322a78663bb816e64fd9211f857d923c49ca122f934744b562cbd7949dc1afbc9ab612567bad94b3384131234036b7a7ca1ca8e275c6f803ab98fd7c0f55
-
SSDEEP
24576:ofvtRr+bm7g5hCLcv2wSwmNjHXKoox7pDgEjNZ1iDX/FVy3IQ:uvLr+3uLcvDSwmNjK5GWc/PKIQ
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2116 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2116 EXCEL.EXE 2116 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\VET Stmt.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:2212