Analysis
-
max time kernel
32s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 22:02
Static task
static1
Behavioral task
behavioral1
Sample
0a077e1651b54097203b7bcfc505a4838909e81044c49d5bf82a28ec3c544c31.xls
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a077e1651b54097203b7bcfc505a4838909e81044c49d5bf82a28ec3c544c31.xls
Resource
win10v2004-20240611-en
General
-
Target
0a077e1651b54097203b7bcfc505a4838909e81044c49d5bf82a28ec3c544c31.xls
-
Size
42KB
-
MD5
2fcfdcfc7118f61d60eb007470fd0b08
-
SHA1
4490b6bac94eb9f34a6d702180c2a88757300034
-
SHA256
0a077e1651b54097203b7bcfc505a4838909e81044c49d5bf82a28ec3c544c31
-
SHA512
441e265dcc5d2dba5ead8a50429d96877b02fdf7526f69d895d91226b3f4b1d691157d29c14c9c9814376aad9ec89232e1deb56aa6f86d13d139a76d20dfb76d
-
SSDEEP
768:ATQd/HxEtjPOtioVjDGUU1qfDlaGGx+cWYIxAHD+a45GgcRslafpea8/jKaPvkFN:tHxEtjPOtioVjDGUU1qfDlaGGx+cWYIY
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4520 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE 4520 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0a077e1651b54097203b7bcfc505a4838909e81044c49d5bf82a28ec3c544c31.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD512a2cc01237adbabc8c5378a30389571
SHA1098a84243ad7e0d2e4ac484a4e666c482cd41375
SHA256b426b49e4ac38253a600a06c9da1532830b42e8a44175da068f7406447259fac
SHA51219318d65c66d8eed758c770d4a43ae63de875bae4c9c415e56ef7745c06e7890edda1e4412261851ebdd628737efd8cc3033bbd5f63206578a21bf9d91f5f827
-
Filesize
256B
MD5c6b1a5f0fabb13661274b6680a92fb51
SHA1fb4f7039b2ebec3cb4437d95d522525294cadccc
SHA2563187033c928e0b968eba0b2ade93ae172fe40093bb6f99ac4b3f8a0d5fd506d1
SHA51225138c9e45282406b41ed01d2dc97da4be0db6cb254b8bac28244990065264390c6514d163f95e32993d91d9c77366de8de26440f51ac873da7ac97feff0d221