Analysis
-
max time kernel
47s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 22:09
Behavioral task
behavioral1
Sample
6e615f63284ed65218683810aa0c9f4111a3b8b0436e09d6fa7afdaca24e634d.xls
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6e615f63284ed65218683810aa0c9f4111a3b8b0436e09d6fa7afdaca24e634d.xls
Resource
win10v2004-20240709-en
General
-
Target
6e615f63284ed65218683810aa0c9f4111a3b8b0436e09d6fa7afdaca24e634d.xls
-
Size
896KB
-
MD5
89d6e17c1dc87166d4d3ad787fa779a8
-
SHA1
3aa1900afa5c37fdac3dd18ab4a9037405d1175d
-
SHA256
6e615f63284ed65218683810aa0c9f4111a3b8b0436e09d6fa7afdaca24e634d
-
SHA512
2bc010c802586a37598313a68f4676492e3ea18b2fcd26d1d73decfda9da847d61eb691b376db8365de769bb15cac9cf0f45687b0d64f6a303a37481c57fac78
-
SSDEEP
12288:1QjtNTh5iNjVwIEyYVIVTa+R0WU/96bKYwXWhiVZATT8:KT7Ac0a+R0n16b/hiqQ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 508 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 508 EXCEL.EXE 508 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE 508 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6e615f63284ed65218683810aa0c9f4111a3b8b0436e09d6fa7afdaca24e634d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD556b04e1ad450dec822892083b5acce35
SHA1f82e8bef06a8a631de2107cf3ead37663b21077b
SHA256856f076b33fbdbc6b1afb17c83ade97d309902c9f98ff10317045bac6b0b6602
SHA512a8469a6c7f3071f920c22030b0680db189d4bd1661072e580f7d325920be8833a72ae54488b1e9abc509379ff336105d986e7ac1bf932a604b6d43dcac10ffd0