Analysis
-
max time kernel
47s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 21:09
Behavioral task
behavioral1
Sample
773bedb309767c5c171b87a4242b46eaf0ad98433cbef3a194764152f080fba3.xlsm
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
773bedb309767c5c171b87a4242b46eaf0ad98433cbef3a194764152f080fba3.xlsm
Resource
win10v2004-20240730-en
General
-
Target
773bedb309767c5c171b87a4242b46eaf0ad98433cbef3a194764152f080fba3.xlsm
-
Size
92KB
-
MD5
2a18f7c379e63d427f5615eb57b01993
-
SHA1
46d1b5abded5a42ed999b34d1ce58105d23010f9
-
SHA256
773bedb309767c5c171b87a4242b46eaf0ad98433cbef3a194764152f080fba3
-
SHA512
fac029b4039945da1591b00359497f9e9c5daaa6ade0cc806b3454f7a91c3cd0ddb30087ed21e4189e910e36fa36fdf74436e4595117f9467163aaac87e2310a
-
SSDEEP
1536:CguZCa6S5khUIM2Od4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIPFa:CgugapkhlMdaPjpM+d/Ms8ULavLc5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 544 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE 544 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\773bedb309767c5c171b87a4242b46eaf0ad98433cbef3a194764152f080fba3.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:544