Overview
overview
7Static
static
7DATA/StarEnc.exe
windows7-x64
1DATA/StarEnc.exe
windows10-2004-x64
1DATA/StarEnc.htm
windows7-x64
1DATA/StarEnc.htm
windows10-2004-x64
1StarOCRM.exe
windows7-x64
6StarOCRM.exe
windows10-2004-x64
6Templates/Action.xls
windows7-x64
1Templates/Action.xls
windows10-2004-x64
1Templates/...er.xls
windows7-x64
1Templates/...er.xls
windows10-2004-x64
1Templates/...rO.xls
windows7-x64
1Templates/...rO.xls
windows10-2004-x64
1Templates/...rS.xls
windows7-x64
1Templates/...rS.xls
windows10-2004-x64
1Templates/...ep.xls
windows7-x64
1Templates/...ep.xls
windows10-2004-x64
1Templates/...rd.xls
windows7-x64
1Templates/...rd.xls
windows10-2004-x64
1Templates/SaleO.xls
windows7-x64
1Templates/SaleO.xls
windows10-2004-x64
1Templates/SalePre.xls
windows7-x64
1Templates/SalePre.xls
windows10-2004-x64
1Templates/SaleS.xls
windows7-x64
1Templates/SaleS.xls
windows10-2004-x64
1Templates/bargain.xls
windows7-x64
1Templates/bargain.xls
windows10-2004-x64
1Templates/...nE.xls
windows7-x64
1Templates/...nE.xls
windows10-2004-x64
1Templates/...lk.xls
windows7-x64
1Templates/...lk.xls
windows10-2004-x64
1Templates/client.xls
windows7-x64
1Templates/client.xls
windows10-2004-x64
1Analysis
-
max time kernel
100s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 08:35
Behavioral task
behavioral1
Sample
DATA/StarEnc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
DATA/StarEnc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
DATA/StarEnc.htm
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
DATA/StarEnc.htm
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
StarOCRM.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
StarOCRM.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
Templates/Action.xls
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Templates/Action.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
Templates/BuyOrder.xls
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Templates/BuyOrder.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
Templates/BuyOrderO.xls
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Templates/BuyOrderO.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
Templates/BuyOrderS.xls
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Templates/BuyOrderS.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Templates/PriceRep.xls
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Templates/PriceRep.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Templates/RepairCard.xls
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Templates/RepairCard.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
Templates/SaleO.xls
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
Templates/SaleO.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
Templates/SalePre.xls
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Templates/SalePre.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
Templates/SaleS.xls
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
Templates/SaleS.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
Templates/bargain.xls
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Templates/bargain.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Templates/bargainE.xls
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Templates/bargainE.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
Templates/chairtalk.xls
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Templates/chairtalk.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
Templates/client.xls
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
Templates/client.xls
Resource
win10v2004-20240704-en
General
-
Target
Templates/SaleO.xls
-
Size
19KB
-
MD5
fe7411c2153dd5a1d46ad8e9c085c7f0
-
SHA1
7e1a6706d9d208ff92194aa5a6ee43037ae166cd
-
SHA256
3b4f3b28832566aa43872a7b84aa094860ee2c6cb0fd382bfdae91cf8efda3ef
-
SHA512
d33bbde2d0d1ee0781cff96f0f118c779dcfe5f30d4625f64351e62e3935ae6b6c9ea9f7c284443c6da0c99a216518fab54775ca33491dc3912e06ab7bcb040a
-
SSDEEP
384:OPZcPCnUGpLq2HbR2xU2DQ7FLTWFuSeAm6PVTcpUdw1:kZcPCnLpLq2HbR2pcSdw1
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2368 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2368 EXCEL.EXE 2368 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Templates\SaleO.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD558657a5727ad909766ac5e7ae0b26287
SHA160c4ca53fd241329e6de39576d3c8f6f60639ffd
SHA256b5e87382a6c4bb3e9ec2527411525d6d63bc1926066bd46af191ef711fb6b745
SHA512e6a6ce4b41ba8d9174b6e165d05b16a8af827a53401ae6781dfc47a3bb70d10c73d9304f6b46e1fb7c4b6429266da57ed1fc948fbf0ca425481feff418dd069c