Analysis
-
max time kernel
46s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 21:06
Behavioral task
behavioral1
Sample
82dcccd46ac8716ad0ae20e7840f331dc3eb5d61643e9e2faa9cc78c1cfdef20.xlsm
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
82dcccd46ac8716ad0ae20e7840f331dc3eb5d61643e9e2faa9cc78c1cfdef20.xlsm
Resource
win10v2004-20240508-en
General
-
Target
82dcccd46ac8716ad0ae20e7840f331dc3eb5d61643e9e2faa9cc78c1cfdef20.xlsm
-
Size
92KB
-
MD5
482fdacc70568a97123a4b8d8833770d
-
SHA1
096b3623c18346718af877e34c6dd924db0285c8
-
SHA256
82dcccd46ac8716ad0ae20e7840f331dc3eb5d61643e9e2faa9cc78c1cfdef20
-
SHA512
7b2bcf152931cc2f2249c2b3b3c01a253f68c23123b0ed126f874d0bae6536eaec807319c82090886382444d7ab504d82c93e026bd7e06b6b8fb0ca236cadedf
-
SSDEEP
1536:CguZCa6S5khUIJHIyCk/4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIAVLF8:CgugapkhlpXaPjpM+d/Ms8ULavLcm
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3244 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3244 EXCEL.EXE 3244 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE 3244 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\82dcccd46ac8716ad0ae20e7840f331dc3eb5d61643e9e2faa9cc78c1cfdef20.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3244