8de600a88650d22bad284c4c8a2ee009795117d3389248f4104420dce11b9a0b

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xshell软件排查结果反馈/其他材料/附件-xshell软件排查结果反馈表.xlsx
Size

16KB
MD5

fe154267585de18c4720ef67c26ba17a
SHA1

a2839f79014c2cbb610b7e15168e841bf745d237
SHA256

d7f315ee9327145bcff84eee2341306aea186b768c25c86cacc15c33d87776fb
SHA512

90d77749804f7f03e4e759d06313360bd0a93a884d133c31f4819666253a479eb25e3d35c54fea260a4d742faa21bcd45369bb92185b23e19d34c1d7ed0ea411
SSDEEP

384:NuhFHfZTnoE+ibQCbbW0Xjt2Jpu5gRiSltXLcqK1180weK2:NuL/ZTPzz5FSlt4qK1jw+

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4564 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

4564 EXCEL.EXE
4564 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE
4564	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\xshell软件排查结果反馈\其他材料\附件-xshell软件排查结果反馈表.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4564

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4564-0-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download
memory/4564-3-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-1-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download
memory/4564-2-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download
memory/4564-4-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-6-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-7-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download
memory/4564-8-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-5-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download
memory/4564-9-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-10-0x00007FF8587C0000-0x00007FF8587D0000-memory.dmp

Filesize
64KB

Download
memory/4564-11-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-12-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-13-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-14-0x00007FF8587C0000-0x00007FF8587D0000-memory.dmp

Filesize
64KB

Download
memory/4564-15-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-16-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-17-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-18-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-31-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-47-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download
memory/4564-48-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download
memory/4564-49-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-46-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download
memory/4564-51-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-52-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-54-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-53-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Filesize
2.0MB

Download
memory/4564-50-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Filesize
64KB

Download