Analysis
-
max time kernel
46s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 21:04
Behavioral task
behavioral1
Sample
8b686771aab7c8e9009ffb2360c3d6c1f80dc7f33d5f0c8247b00c2048f2a23b.xlsm
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8b686771aab7c8e9009ffb2360c3d6c1f80dc7f33d5f0c8247b00c2048f2a23b.xlsm
Resource
win10v2004-20240802-en
General
-
Target
8b686771aab7c8e9009ffb2360c3d6c1f80dc7f33d5f0c8247b00c2048f2a23b.xlsm
-
Size
92KB
-
MD5
6b61b0a3b587b8567a88da9a3df0e879
-
SHA1
c14782cd6e0987179b200596971fac013ac29315
-
SHA256
8b686771aab7c8e9009ffb2360c3d6c1f80dc7f33d5f0c8247b00c2048f2a23b
-
SHA512
954d15a60bc122e8dfd98514501a23c1a1095e220b944932c94a7f51613aeb6166601e50689dc6d3a984cecb7d32a08f0389d38c4d8574d4e78b04d002b7bd40
-
SSDEEP
1536:CguZCa6S5khUIqz3LT4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIvwFo:Cgugapkhl2bTaPjpM+d/Ms8ULavLcI
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3876 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE 3876 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8b686771aab7c8e9009ffb2360c3d6c1f80dc7f33d5f0c8247b00c2048f2a23b.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3876