Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
66b66fcd3ebb2a51ef73fae0049f5029215ce432d3647bc54ee5245912a6c955.xlsb
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
66b66fcd3ebb2a51ef73fae0049f5029215ce432d3647bc54ee5245912a6c955.xlsb
Resource
win10v2004-20240508-en
General
-
Target
66b66fcd3ebb2a51ef73fae0049f5029215ce432d3647bc54ee5245912a6c955.xlsb
-
Size
1.6MB
-
MD5
a63485b442a8206671ebc6a88be95235
-
SHA1
6527d42ec4b02786a32169dab0389a4774ad19b8
-
SHA256
66b66fcd3ebb2a51ef73fae0049f5029215ce432d3647bc54ee5245912a6c955
-
SHA512
f20136bc6815771eda601eb610b69fe151a708c1efc1f0774023ae9c5ae08394bde0877d9b413e39fd21b33cb88bed0737ceab29dc8218a12d8d972ac5beec59
-
SSDEEP
49152:un29XzQSjOwUpz7qI6AtLqj+Kxaj/zEpSbbHJ:ASKwczOIdlEaj/zEsfJ
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
EXCEL.EXEdescription ioc process File opened (read-only) \??\Y: EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1780 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
EXCEL.EXEpid process 1780 EXCEL.EXE 1780 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EXCEL.EXEdescription pid process Token: SeDebugPrivilege 1780 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1780 EXCEL.EXE 1780 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
EXCEL.EXEpid process 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE 1780 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\66b66fcd3ebb2a51ef73fae0049f5029215ce432d3647bc54ee5245912a6c955.xlsb"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1780-0-0x00007FFE76310000-0x00007FFE76320000-memory.dmpFilesize
64KB
-
memory/1780-2-0x00007FFE76310000-0x00007FFE76320000-memory.dmpFilesize
64KB
-
memory/1780-1-0x00007FFE76310000-0x00007FFE76320000-memory.dmpFilesize
64KB
-
memory/1780-3-0x00007FFE76310000-0x00007FFE76320000-memory.dmpFilesize
64KB
-
memory/1780-4-0x00007FFEB632D000-0x00007FFEB632E000-memory.dmpFilesize
4KB
-
memory/1780-7-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-6-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-5-0x00007FFE76310000-0x00007FFE76320000-memory.dmpFilesize
64KB
-
memory/1780-8-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-9-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-11-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-10-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-12-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-13-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-14-0x00007FFE73FD0000-0x00007FFE73FE0000-memory.dmpFilesize
64KB
-
memory/1780-15-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-17-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-18-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-16-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-19-0x00007FFE73FD0000-0x00007FFE73FE0000-memory.dmpFilesize
64KB
-
memory/1780-31-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-33-0x000002D65AB50000-0x000002D65ACF2000-memory.dmpFilesize
1.6MB
-
memory/1780-32-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-34-0x000002D675980000-0x000002D6783E0000-memory.dmpFilesize
42.4MB
-
memory/1780-35-0x000002D65AD00000-0x000002D65AF94000-memory.dmpFilesize
2.6MB
-
memory/1780-36-0x000002D657690000-0x000002D6576EC000-memory.dmpFilesize
368KB
-
memory/1780-38-0x000002D657630000-0x000002D657652000-memory.dmpFilesize
136KB
-
memory/1780-37-0x000002D65A970000-0x000002D65AB32000-memory.dmpFilesize
1.8MB
-
memory/1780-39-0x000002D65BD30000-0x000002D65CAC0000-memory.dmpFilesize
13.6MB
-
memory/1780-40-0x000002D650190000-0x000002D6501A0000-memory.dmpFilesize
64KB
-
memory/1780-41-0x000002D657710000-0x000002D65771A000-memory.dmpFilesize
40KB
-
memory/1780-42-0x000002D657720000-0x000002D657742000-memory.dmpFilesize
136KB
-
memory/1780-43-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-44-0x000002D67C700000-0x000002D680A16000-memory.dmpFilesize
67.1MB
-
memory/1780-45-0x000002D657750000-0x000002D657778000-memory.dmpFilesize
160KB
-
memory/1780-46-0x000002D6577D0000-0x000002D657820000-memory.dmpFilesize
320KB
-
memory/1780-47-0x000002D6501B0000-0x000002D6501C0000-memory.dmpFilesize
64KB
-
memory/1780-48-0x000002D6576F0000-0x000002D657708000-memory.dmpFilesize
96KB
-
memory/1780-49-0x000002D657880000-0x000002D6578DA000-memory.dmpFilesize
360KB
-
memory/1780-53-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-54-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-55-0x000002D65B4D0000-0x000002D65B9F8000-memory.dmpFilesize
5.2MB
-
memory/1780-80-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-81-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-82-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-85-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-86-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-87-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-88-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB
-
memory/1780-89-0x00007FFEB6290000-0x00007FFEB6485000-memory.dmpFilesize
2.0MB