ef385ed64f795e106d17c0a53dfb398f774a555a9e287714d327bf3987364c1b

General

Target

ef385ed64f795e106d17c0a53dfb398f774a555a9e287714d327bf3987364c1b.xls
Size

1.5MB
MD5

72e371542ad6fda96bb3fc3b1ee68d92
SHA1

3f37ca0db6442743e34768e44450752637930523
SHA256

ef385ed64f795e106d17c0a53dfb398f774a555a9e287714d327bf3987364c1b
SHA512

1e39b831c912f38297c75e30a89583998a4c27ada484bab58c8e91a0248550152ee29f2e79f5f9a8266e0864d17fdc0cfcf6b9cf62787ca3744dc3bd33bb68ec
SSDEEP

24576:RLcW759A2A0gNbth/2cFdT7My+fg9V5cT:qWVe2hg9X/7dT7MJ45

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4156 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE
4156	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ef385ed64f795e106d17c0a53dfb398f774a555a9e287714d327bf3987364c1b.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3812 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-0-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-2-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-1-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-3-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-4-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-5-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-6-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-7-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-8-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-9-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-11-0x00007FFD54A60000-0x00007FFD54A70000-memory.dmp

Filesize
64KB

Download
memory/4156-12-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-10-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-14-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-13-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-15-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-16-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-17-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-19-0x00007FFD54A60000-0x00007FFD54A70000-memory.dmp

Filesize
64KB

Download
memory/4156-29-0x000001A766B30000-0x000001A766D30000-memory.dmp

Filesize
2.0MB

Download
memory/4156-33-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-34-0x000001A761290000-0x000001A762260000-memory.dmp

Filesize
15.8MB

Download
memory/4156-35-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-36-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-37-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-38-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-39-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download
memory/4156-86-0x000001A766B30000-0x000001A766D30000-memory.dmp

Filesize
2.0MB

Download
memory/4156-87-0x000001A761290000-0x000001A762260000-memory.dmp

Filesize
15.8MB

Download
memory/4156-106-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-107-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-108-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-109-0x00007FFD57310000-0x00007FFD57320000-memory.dmp

Filesize
64KB

Download
memory/4156-110-0x00007FFD97290000-0x00007FFD97485000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads