Analysis
-
max time kernel
149s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 13:10
Behavioral task
behavioral1
Sample
overview.xlsm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
overview.xlsm
Resource
win10v2004-20240412-en
General
-
Target
overview.xlsm
-
Size
66KB
-
MD5
9f8b33bf47ab27233a403c51cc4f506b
-
SHA1
b6965e1a8ef10e5a71462ae8f831a217910229a1
-
SHA256
533b5186f54d047afab38b37301a56cc599f06d36ccca275455bb565db64acf7
-
SHA512
914401533acf1af8b4c895e2c686c80485491a5ec9e5f052113a5f29b7b9a602e338c44cce81c325549ac320e47ad7bdc4959097b4fba903d4b4d7719977e86b
-
SSDEEP
1536:MZXMDD65mVpxdRExYSL02uHtQLEaDOo9JU1O2u9ffUomG8i52caNOzG2:pomtib
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4120 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EXCEL.EXEdescription pid process Token: SeAuditPrivilege 4120 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE 4120 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\overview.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4120-0-0x00007FF895770000-0x00007FF895780000-memory.dmpFilesize
64KB
-
memory/4120-2-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-3-0x00007FF895770000-0x00007FF895780000-memory.dmpFilesize
64KB
-
memory/4120-5-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-6-0x00007FF895770000-0x00007FF895780000-memory.dmpFilesize
64KB
-
memory/4120-4-0x00007FF895770000-0x00007FF895780000-memory.dmpFilesize
64KB
-
memory/4120-1-0x00007FF895770000-0x00007FF895780000-memory.dmpFilesize
64KB
-
memory/4120-7-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-8-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-9-0x00007FF8934B0000-0x00007FF8934C0000-memory.dmpFilesize
64KB
-
memory/4120-10-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-11-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-13-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-14-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-12-0x00007FF8934B0000-0x00007FF8934C0000-memory.dmpFilesize
64KB
-
memory/4120-15-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-16-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-17-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-18-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-20-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-19-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-22-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-21-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-23-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-36-0x0000012839460000-0x0000012839C60000-memory.dmpFilesize
8.0MB
-
memory/4120-37-0x0000012839460000-0x0000012839C60000-memory.dmpFilesize
8.0MB
-
memory/4120-38-0x0000012839460000-0x0000012839C60000-memory.dmpFilesize
8.0MB
-
memory/4120-55-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-56-0x00007FF8D56F0000-0x00007FF8D58E5000-memory.dmpFilesize
2.0MB
-
memory/4120-57-0x0000012839460000-0x0000012839C60000-memory.dmpFilesize
8.0MB
-
memory/4120-58-0x0000012839460000-0x0000012839C60000-memory.dmpFilesize
8.0MB
-
memory/4120-59-0x0000012839460000-0x0000012839C60000-memory.dmpFilesize
8.0MB