Analysis
-
max time kernel
47s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 02:31
Behavioral task
behavioral1
Sample
4093e42f727a461d6573faae40fe962e074ce6a03891bdaee91d7ce7f5af44b9.xls
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4093e42f727a461d6573faae40fe962e074ce6a03891bdaee91d7ce7f5af44b9.xls
Resource
win10v2004-20240508-en
General
-
Target
4093e42f727a461d6573faae40fe962e074ce6a03891bdaee91d7ce7f5af44b9.xls
-
Size
167KB
-
MD5
8d37c328cbcb7b46ed712827f01e46b5
-
SHA1
42ca84dcae84c954291d6e850514c906f766dc8a
-
SHA256
4093e42f727a461d6573faae40fe962e074ce6a03891bdaee91d7ce7f5af44b9
-
SHA512
0a83d5df5c1008b888c8a2e717809f1b4b40c0add99dfcb9c79cd83bcf62d35599326f4523e17cf32405d7a224e27f232c9509715d6bef7d3abdf3c23272e653
-
SSDEEP
3072:A6nxEtjPOtioVjDGUU1qfDlaGGx+cLYIxKOkAMQ9SHX1:nxEtjPOtioVjDGUU1qfDlavx+WYIxKOI
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2880 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4093e42f727a461d6573faae40fe962e074ce6a03891bdaee91d7ce7f5af44b9.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2880