Overview
overview
7Static
static
7DATA/StarEnc.exe
windows7-x64
1DATA/StarEnc.exe
windows10-2004-x64
1DATA/StarEnc.htm
windows7-x64
1DATA/StarEnc.htm
windows10-2004-x64
1StarOCRM.exe
windows7-x64
6StarOCRM.exe
windows10-2004-x64
6Templates/Action.xls
windows7-x64
1Templates/Action.xls
windows10-2004-x64
1Templates/...er.xls
windows7-x64
1Templates/...er.xls
windows10-2004-x64
1Templates/...rO.xls
windows7-x64
1Templates/...rO.xls
windows10-2004-x64
1Templates/...rS.xls
windows7-x64
1Templates/...rS.xls
windows10-2004-x64
1Templates/...ep.xls
windows7-x64
1Templates/...ep.xls
windows10-2004-x64
1Templates/...rd.xls
windows7-x64
1Templates/...rd.xls
windows10-2004-x64
1Templates/SaleO.xls
windows7-x64
1Templates/SaleO.xls
windows10-2004-x64
1Templates/SalePre.xls
windows7-x64
1Templates/SalePre.xls
windows10-2004-x64
1Templates/SaleS.xls
windows7-x64
1Templates/SaleS.xls
windows10-2004-x64
1Templates/bargain.xls
windows7-x64
1Templates/bargain.xls
windows10-2004-x64
1Templates/...nE.xls
windows7-x64
1Templates/...nE.xls
windows10-2004-x64
1Templates/...lk.xls
windows7-x64
1Templates/...lk.xls
windows10-2004-x64
1Templates/client.xls
windows7-x64
1Templates/client.xls
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 08:35
Behavioral task
behavioral1
Sample
DATA/StarEnc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
DATA/StarEnc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
DATA/StarEnc.htm
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
DATA/StarEnc.htm
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
StarOCRM.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
StarOCRM.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
Templates/Action.xls
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Templates/Action.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
Templates/BuyOrder.xls
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Templates/BuyOrder.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
Templates/BuyOrderO.xls
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Templates/BuyOrderO.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
Templates/BuyOrderS.xls
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Templates/BuyOrderS.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Templates/PriceRep.xls
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Templates/PriceRep.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Templates/RepairCard.xls
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Templates/RepairCard.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
Templates/SaleO.xls
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
Templates/SaleO.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
Templates/SalePre.xls
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Templates/SalePre.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
Templates/SaleS.xls
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
Templates/SaleS.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
Templates/bargain.xls
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Templates/bargain.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Templates/bargainE.xls
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
Templates/bargainE.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
Templates/chairtalk.xls
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Templates/chairtalk.xls
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
Templates/client.xls
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
Templates/client.xls
Resource
win10v2004-20240704-en
General
-
Target
Templates/Action.xls
-
Size
18KB
-
MD5
9e4bb1f32c3deac9ec235548b0299bca
-
SHA1
4532b9ad26c5407b31c8085725de193521ff6bdf
-
SHA256
b28aa179eb88cd7b028b9484972da41a64549d6aca3f249228b24c3e94ee8274
-
SHA512
387fb1521abb24ba931d0403fde46f23c9296f59fe30ad3e926748464957a192f0ef040e6305d8176fa9f477ce42e8a242f118b57ad95bd6f3a29f3ce6bdb8cf
-
SSDEEP
384:GpBtqCR22ro0QVeGbLjbtK2zzt1LHpsueTl8DqWAQ:GpBtqCR2g2suE8OWAQ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1632 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE 1632 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Templates\Action.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD586be1a142618bbe5ac5418495582e5a6
SHA1e63ac64d29307168a59eb8e83bbbfde1fd2be6b7
SHA25644e5e3ea24bd9a0f42db1985765edc43039cacbde85e723b7bebb6dff8de30dd
SHA5127839d70d893cbde932486a20aa9ea9c4fcf5968dd5db80c3aed36235bf725ca79580389fa77a9c5a2919efde1afc9ac5c5172e96bb9bdb5db1e29d79a39c1ba4