Analysis
-
max time kernel
47s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 21:09
Behavioral task
behavioral1
Sample
10326b8040028a64e0d96fffb8eaf772a86c9f6b6fa6c2968ba651c79db52789.xlsm
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10326b8040028a64e0d96fffb8eaf772a86c9f6b6fa6c2968ba651c79db52789.xlsm
Resource
win10v2004-20240611-en
General
-
Target
10326b8040028a64e0d96fffb8eaf772a86c9f6b6fa6c2968ba651c79db52789.xlsm
-
Size
92KB
-
MD5
706886d6dd92a35e51944e5ae834b50f
-
SHA1
6dfdf6f14c8d0b310a55e8d6998908503aeeb49a
-
SHA256
10326b8040028a64e0d96fffb8eaf772a86c9f6b6fa6c2968ba651c79db52789
-
SHA512
e127d60a460fe964929b55f149011eb55ce510c8757ae9999d43ac93339fd60b854fe878b4141a01555b3a09fe373667512ccac5fa924b21436a6c5afa673853
-
SSDEEP
1536:CguZCa6S5khUITw1thnv1Onu4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIlHFs:CgugapkhlTwV1cuaPjpM+d/Ms8ULavLM
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2916 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE 2916 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\10326b8040028a64e0d96fffb8eaf772a86c9f6b6fa6c2968ba651c79db52789.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2916