Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 02:41
Behavioral task
behavioral1
Sample
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls
Resource
win10v2004-20240709-en
General
-
Target
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls
-
Size
1.3MB
-
MD5
6a5b15d9e6bb033e46489be8cdd09849
-
SHA1
c67e28a3dc3bd24b3013ed445e961dac2bc40905
-
SHA256
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9
-
SHA512
f3af74171844d7a91de289921b670215b5534c7c7a98e707e2750fbc2c46705811ce121f02fc2bab7b269e208dd1796de385e3aab4a19ec9ebb369843de77e76
-
SSDEEP
24576:TCEyzgdI6eFAj99CB5ml31tD1HlmKQPpsmsyX1JRIwIz1QVEl:TCEwT6eFAj3Cjm3HlUhOa1nRRVA
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3868 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3868 EXCEL.EXE 3868 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3868 wrote to memory of 1772 3868 EXCEL.EXE 86 PID 3868 wrote to memory of 1772 3868 EXCEL.EXE 86
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1772
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84