f03875031911049628277314fa9677e7e8fe82c63ed40bf3ac707cbab061c9fe

Analysis

max time kernel
136s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed7b525ff2b5d6c2a63878a1d7594b12025f3d7525898adb3c02cb958df09be7.xlsx
Size

125KB
MD5

594b073b5b5d30deedf9b4c045b63f7e
SHA1

ce4c3d5b9d7865d732e8edc2ee077ecfacc230ed
SHA256

ed7b525ff2b5d6c2a63878a1d7594b12025f3d7525898adb3c02cb958df09be7
SHA512

57f184eb98feb70bc92ad0762c8ba598a0860cb5a53307b8af4735f26e9b7964d984d5145af54f8466718e97a369bf9afe120286172544a2d05e5af4b15ad54d
SSDEEP

3072:HdALcrcUNpHoD1ANvzCtmwkEa+EdeG9UgicNvEDS6J9:HG446pikzCkrEaddeG9Ugi6+S69

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3044 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE
3044	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ed7b525ff2b5d6c2a63878a1d7594b12025f3d7525898adb3c02cb958df09be7.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-1-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-3-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-2-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-4-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-5-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-8-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-7-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-9-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-6-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-10-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-11-0x00007FFBA06D0000-0x00007FFBA06E0000-memory.dmp

Filesize
64KB

Download
memory/3044-12-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-15-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-14-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-16-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-13-0x00007FFBA06D0000-0x00007FFBA06E0000-memory.dmp

Filesize
64KB

Download
memory/3044-17-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-18-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-19-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-20-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-21-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-22-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-23-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-36-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-37-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-52-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-53-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-54-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-56-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-55-0x00007FFBA2950000-0x00007FFBA2960000-memory.dmp

Filesize
64KB

Download
memory/3044-57-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-58-0x00007FFBE28D0000-0x00007FFBE2AC5000-memory.dmp

Filesize
2.0MB

Download