Overview
overview
7Static
static
7DATA/StarEnc.exe
windows7-x64
1DATA/StarEnc.exe
windows10-2004-x64
1DATA/StarEnc.htm
windows7-x64
1DATA/StarEnc.htm
windows10-2004-x64
1StarOCRM.exe
windows7-x64
6StarOCRM.exe
windows10-2004-x64
6Templates/Action.xls
windows7-x64
1Templates/Action.xls
windows10-2004-x64
1Templates/...er.xls
windows7-x64
1Templates/...er.xls
windows10-2004-x64
1Templates/...rO.xls
windows7-x64
1Templates/...rO.xls
windows10-2004-x64
1Templates/...rS.xls
windows7-x64
1Templates/...rS.xls
windows10-2004-x64
1Templates/...ep.xls
windows7-x64
1Templates/...ep.xls
windows10-2004-x64
1Templates/...rd.xls
windows7-x64
1Templates/...rd.xls
windows10-2004-x64
1Templates/SaleO.xls
windows7-x64
1Templates/SaleO.xls
windows10-2004-x64
1Templates/SalePre.xls
windows7-x64
1Templates/SalePre.xls
windows10-2004-x64
1Templates/SaleS.xls
windows7-x64
1Templates/SaleS.xls
windows10-2004-x64
1Templates/bargain.xls
windows7-x64
1Templates/bargain.xls
windows10-2004-x64
1Templates/...nE.xls
windows7-x64
1Templates/...nE.xls
windows10-2004-x64
1Templates/...lk.xls
windows7-x64
1Templates/...lk.xls
windows10-2004-x64
1Templates/client.xls
windows7-x64
1Templates/client.xls
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 08:35
Behavioral task
behavioral1
Sample
DATA/StarEnc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
DATA/StarEnc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
DATA/StarEnc.htm
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
DATA/StarEnc.htm
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
StarOCRM.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
StarOCRM.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
Templates/Action.xls
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Templates/Action.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
Templates/BuyOrder.xls
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Templates/BuyOrder.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
Templates/BuyOrderO.xls
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Templates/BuyOrderO.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
Templates/BuyOrderS.xls
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Templates/BuyOrderS.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Templates/PriceRep.xls
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Templates/PriceRep.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Templates/RepairCard.xls
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Templates/RepairCard.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
Templates/SaleO.xls
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
Templates/SaleO.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
Templates/SalePre.xls
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Templates/SalePre.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
Templates/SaleS.xls
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
Templates/SaleS.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
Templates/bargain.xls
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Templates/bargain.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Templates/bargainE.xls
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Templates/bargainE.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
Templates/chairtalk.xls
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Templates/chairtalk.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
Templates/client.xls
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
Templates/client.xls
Resource
win10v2004-20240704-en
General
-
Target
Templates/client.xls
-
Size
23KB
-
MD5
44f8553782ffea41d19494620edb52d6
-
SHA1
892a68363a71b74aa88cb741a32871fb83fff9cd
-
SHA256
625184755cdfd4d51dbc76f32f1ee80aad892995a5516a96f58774dc6ad9e335
-
SHA512
d22d2c9d0a987c50a14b4b3da2c5f4614308fbfabfcc543b3e458b8370455c32858f5bf6ed8186f132b8565274a71273102f62d291518a2bb51b61c4b5f8c273
-
SSDEEP
384:PBgqOWdbG/KR2cAlLYjCA9gauJ49jfiU8ORa8888v:PBgqOWdbG/KR2qh6DORc
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3464 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE 3464 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Templates\client.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD552759f87c00deddd5ad4fd2af5eb5bcb
SHA1564d3369036fc2a36e487120bf506b1083f6883d
SHA256c2c92abb8168ce5c2f07645138426151bb8157422bca29f80bcda3788d58ed5f
SHA512be859aae282c3b3e52df19de09faa4e4bf27e2fa2904ec0692c8368c2f4bbefaaeb286e24c734665713aec2eef6cb4dc7329f510039e5b244a3e44ee4fdb4c40