997a53f437f3a3b2f73416cf3de9059e22ec9d507a16c6c8ad75417d8e7797bd

Analysis

max time kernel
38s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

997a53f437f3a3b2f73416cf3de9059e22ec9d507a16c6c8ad75417d8e7797bd.xls
Size

72KB
MD5

4546f09bed8c7f41e9e986dc53610c0b
SHA1

6165524555f532007999744fe282ab218435e1cb
SHA256

997a53f437f3a3b2f73416cf3de9059e22ec9d507a16c6c8ad75417d8e7797bd
SHA512

66047791a9a805322e5caacbc139d2fd907b0cbc82466c39f284624467b990e9adda4a832dc005d224fdcb28d74bcc8a2de77f8d0e7d77ba16c471b92a490776
SSDEEP

1536:ftok3hOdsylKlgryzc4bNhZFGzE+kD4LgldAzvJek5o2l:qk3hOdsylKlgryzc4bNhZFGzE+kD4Lg0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1792	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1792	EXCEL.EXE
1792	EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE
1792	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\997a53f437f3a3b2f73416cf3de9059e22ec9d507a16c6c8ad75417d8e7797bd.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-1-0x00007FF867C8D000-0x00007FF867C8E000-memory.dmp

Filesize
4KB

Download
memory/1792-0-0x00007FF827C70000-0x00007FF827C80000-memory.dmp

Filesize
64KB

Download
memory/1792-4-0x00007FF827C70000-0x00007FF827C80000-memory.dmp

Filesize
64KB

Download
memory/1792-3-0x00007FF827C70000-0x00007FF827C80000-memory.dmp

Filesize
64KB

Download
memory/1792-2-0x00007FF827C70000-0x00007FF827C80000-memory.dmp

Filesize
64KB

Download
memory/1792-5-0x00007FF827C70000-0x00007FF827C80000-memory.dmp

Filesize
64KB

Download
memory/1792-7-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-6-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-8-0x00007FF825B00000-0x00007FF825B10000-memory.dmp

Filesize
64KB

Download
memory/1792-9-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-12-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-15-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-17-0x00007FF825B00000-0x00007FF825B10000-memory.dmp

Filesize
64KB

Download
memory/1792-19-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-18-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-16-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-14-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-13-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-11-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-10-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-30-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-38-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-39-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-40-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-44-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download
memory/1792-47-0x00007FF867C8D000-0x00007FF867C8E000-memory.dmp

Filesize
4KB

Download
memory/1792-48-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads