Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 02:51
Static task
static1
Behavioral task
behavioral1
Sample
e0970a736829207ee8becc4eefe92a54.xlsm
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
e0970a736829207ee8becc4eefe92a54.xlsm
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
e0970a736829207ee8becc4eefe92a54.xlsm
-
Size
41KB
-
MD5
e0970a736829207ee8becc4eefe92a54
-
SHA1
dcd3b91465aa386b308fcf0a8bd437855558c3d3
-
SHA256
1735cee8ae52272b7bdf9324de0a1d587c429b8ed882598b45a6673cc0e07b75
-
SHA512
09a164a734790e787ad88feaf8aa1d9699dbe70053adc63c7f7a20cfba52e48bc497016e4bf695264210ca540afb910acda94e92b3ad8d3153fda7f8d8001811
-
SSDEEP
768:eT6hbfxnmrZN0DGCfkyX3eks4pSGn0Qic3qoTyxj0EB:26zgGzfPeUv02dyJ9
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1620 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE 1620 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e0970a736829207ee8becc4eefe92a54.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1620