Analysis
-
max time kernel
47s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 22:07
Behavioral task
behavioral1
Sample
1f6e55dc2e4caf84d3b74c0097e6852cb91f263424816e2d0aede9eee51bc28d.xlsm
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1f6e55dc2e4caf84d3b74c0097e6852cb91f263424816e2d0aede9eee51bc28d.xlsm
Resource
win10v2004-20240802-en
General
-
Target
1f6e55dc2e4caf84d3b74c0097e6852cb91f263424816e2d0aede9eee51bc28d.xlsm
-
Size
92KB
-
MD5
230c03a1400290ff1336bf8162bf1e4e
-
SHA1
5fde7b07b29e090d6db0565c25b866df0bbdf350
-
SHA256
1f6e55dc2e4caf84d3b74c0097e6852cb91f263424816e2d0aede9eee51bc28d
-
SHA512
83bb901505ec5f28b0ea2482eb05be6dc0bd8d4c110df7f8c82919e74fb1fcb21dc98fb210acd0b6eaa2e90f2cd71ad692e3d7cb7dfcafa743d6863810033b47
-
SSDEEP
1536:CguZCa6S5khUIoJqlYq95/G4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIITEFk:Cgugapkhlo4lV/GaPjpM+d/Ms8ULavLt
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 460 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE 460 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1f6e55dc2e4caf84d3b74c0097e6852cb91f263424816e2d0aede9eee51bc28d.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:460