Overview
overview
3Static
static
1stroop-mas...x.html
windows7-x64
1stroop-mas...x.html
windows10-2004-x64
1stroop-mas...ers.js
windows7-x64
1stroop-mas...ers.js
windows10-2004-x64
1stroop-mas...oop.js
windows7-x64
1stroop-mas...oop.js
windows10-2004-x64
1stroop-mas...oop.py
windows7-x64
3stroop-mas...oop.py
windows10-2004-x64
3stroop-mas...run.py
windows7-x64
3stroop-mas...run.py
windows10-2004-x64
3stroop-mas...s.xlsx
windows7-x64
1stroop-mas...s.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
stroop-master/index.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
stroop-master/index.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
stroop-master/stroop-legacy-browsers.js
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
stroop-master/stroop-legacy-browsers.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
stroop-master/stroop.js
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
stroop-master/stroop.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
stroop-master/stroop.py
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
stroop-master/stroop.py
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
stroop-master/stroop_lastrun.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
stroop-master/stroop_lastrun.py
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
stroop-master/trialTypes.xlsx
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
stroop-master/trialTypes.xlsx
Resource
win10v2004-20240412-en
General
-
Target
stroop-master/trialTypes.xlsx
-
Size
9KB
-
MD5
38bdb12bb9788b207eb28f03f756899f
-
SHA1
4b1f6bb7b65e0af57bb137150c0e5482fbfe1f5f
-
SHA256
87c22f474af8b9fbe5907b890973945a30e95f9e81a191cd99b721a5ab789a19
-
SHA512
7735a8ef0aa18660c97419c75633460ff46be707f23819c377cc6bb5dd10ff46200b40d5f5a81efa39ded71a87e6914eacd891cac862f60a205b8c97e1ccb13f
-
SSDEEP
96:wkd8A9V+igFjAnYi3U2zDq0Nr6Ol+c0emSuAGQarWvc+iuHMB77HcOkRr86m3IFZ:wc8mV6Anb3U2FJ6+TuAe+nHMuleQLsM
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2524 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2524 EXCEL.EXE 2524 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\stroop-master\trialTypes.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2524