Analysis
-
max time kernel
130s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 17:22
Static task
static1
Behavioral task
behavioral1
Sample
ACH-9225-15March.xlsx
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ACH-9225-15March.xlsx
Resource
win10v2004-20240226-en
5 signatures
150 seconds
General
-
Target
ACH-9225-15March.xlsx
-
Size
48KB
-
MD5
20f8bdd84478f811b74d653f584e69a3
-
SHA1
b194986696464d38bae10ffff7364cfc73de401c
-
SHA256
0c1b18a8b3f56fc02b245168b55972936a72ffd2dd1746e92b6a35cc25d9a713
-
SHA512
dc0e9a90472c4d05331a0039a384f164d707704a8c7d5fa92f631568a2dcd510ead7225b2dc54c1bd7fda5779c8556234f9b7192e4275e5cecdcd36cb8487498
-
SSDEEP
768:ZFlppbq6i4Y/TJC4xJMxXcvFLwAPq4Sxv9PvEgzegYN1T/Y:tLq94YV7JMxXyd4x+gzexTg
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2092 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2092 EXCEL.EXE 2092 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE 2092 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ACH-9225-15March.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:81⤵PID:4564