Analysis
-
max time kernel
47s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 02:13
Behavioral task
behavioral1
Sample
d52d109e6950671919fd5078790d00840b1c188e99bdc34c5343f4920ee7f41e.xlsm
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d52d109e6950671919fd5078790d00840b1c188e99bdc34c5343f4920ee7f41e.xlsm
Resource
win10v2004-20240426-en
General
-
Target
d52d109e6950671919fd5078790d00840b1c188e99bdc34c5343f4920ee7f41e.xlsm
-
Size
92KB
-
MD5
f5d0beb021115bb50c568397ccf502b1
-
SHA1
1b3b8be3485b3787025edf89ca794c07dfda3883
-
SHA256
d52d109e6950671919fd5078790d00840b1c188e99bdc34c5343f4920ee7f41e
-
SHA512
dc9c46190105c896b5dd53b022de0fe2dabea98edf00a9d579c18adc3e8d1f6d87fd3928fcbfce72a533c803f51b8470d0894bd7cfd4e5f16c1ca63bf17f4db2
-
SSDEEP
1536:CguZCa6S5khUIXv6gEuL1kt4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYII0F1:CgugapkhlfYY1ktaPjpM+d/Ms8ULavLE
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1792 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE 1792 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d52d109e6950671919fd5078790d00840b1c188e99bdc34c5343f4920ee7f41e.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1792