Analysis
-
max time kernel
29s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
5925c92ef4ba57b063d7aa18f4f5ae9a6911bbd33e0036313da91d6652c5f664.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5925c92ef4ba57b063d7aa18f4f5ae9a6911bbd33e0036313da91d6652c5f664.xlsx
Resource
win10v2004-20240226-en
General
-
Target
5925c92ef4ba57b063d7aa18f4f5ae9a6911bbd33e0036313da91d6652c5f664.xlsx
-
Size
65KB
-
MD5
8e076592f693a0513773ae383c326009
-
SHA1
e1747dcb796839e9add06dcf1681c4eb6d4ef598
-
SHA256
5925c92ef4ba57b063d7aa18f4f5ae9a6911bbd33e0036313da91d6652c5f664
-
SHA512
f1a201f4f496562059be098e0cb9e13f62f413aceb456efb98d8e0bab143ae6a7fde3677dab2d487354afb08ddf625023bdbf6bafbfc738d29330189af6116d6
-
SSDEEP
1536:C2i3OnslDGe2eGyIvJhaaO5Ny4iUvRB75d/wSgE9pgyjxOqT6:C3Osj4yIRAzHiE/7n/tgE9pgyjxs
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3924 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE 3924 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5925c92ef4ba57b063d7aa18f4f5ae9a6911bbd33e0036313da91d6652c5f664.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3924