Analysis
-
max time kernel
47s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 01:56
Behavioral task
behavioral1
Sample
003fe3a07cef014bf520d7ccc43512925293b75ff9d9f8858437fb69998fc8bc.xlsm
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
003fe3a07cef014bf520d7ccc43512925293b75ff9d9f8858437fb69998fc8bc.xlsm
Resource
win10v2004-20240508-en
General
-
Target
003fe3a07cef014bf520d7ccc43512925293b75ff9d9f8858437fb69998fc8bc.xlsm
-
Size
92KB
-
MD5
8cc966bdf708bfc892d4f7951694c71c
-
SHA1
cb72d78e6b41f5a74d1ede4185a47229b6b91412
-
SHA256
003fe3a07cef014bf520d7ccc43512925293b75ff9d9f8858437fb69998fc8bc
-
SHA512
76551ddea6751ae78b7975712102b62e10b10a676f6cb0b1764e013bdb92d2fbad37a66fb3770df1363096bdfb449b6828a645bd0a1c9232fb245a8fb2d9b77a
-
SSDEEP
1536:CguZCa6S5khUIsZvQk8pN8Fe4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYII7SFN:CgugapkhlsZU7aPjpM+d/Ms8ULavLcV
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 632 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE 632 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\003fe3a07cef014bf520d7ccc43512925293b75ff9d9f8858437fb69998fc8bc.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:632