Analysis
-
max time kernel
47s -
max time network
46s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2024 21:27
Behavioral task
behavioral1
Sample
68aa3dc595e24aff85aab47dbfd01e382b41e072357aebec61f75faf0d311828.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
68aa3dc595e24aff85aab47dbfd01e382b41e072357aebec61f75faf0d311828.xls
Resource
win10v2004-20240802-en
General
-
Target
68aa3dc595e24aff85aab47dbfd01e382b41e072357aebec61f75faf0d311828.xls
-
Size
33KB
-
MD5
00d5eddf80a010f24ff5cfc34f6ca39e
-
SHA1
ca5610ffd7afb3096e313fd77cb996aadc94e439
-
SHA256
68aa3dc595e24aff85aab47dbfd01e382b41e072357aebec61f75faf0d311828
-
SHA512
6c577d3247764319bcc44b714772d51ada7622a86eaab01b9e0612f662de13e8cdbf2cbcdc66e8c2fef071aeff4f665ba889dcb0e2615c855b881bb71e3fd275
-
SSDEEP
768:wkrk3hOdsylKlgxopeiBNhZFGzE+cL4LglnAZnLoedum8io:pk3hOdsylKlgxopeiBNhZFGzE+cL4LgV
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2564 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\68aa3dc595e24aff85aab47dbfd01e382b41e072357aebec61f75faf0d311828.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD536d6221e264118c008d71f17d520b716
SHA1685c1b0a5f8e7561b524a668cd6b5e5f2d119e2e
SHA256edcc9dba7dd8243fada1675c08fa9cc8a060f6155bfbed566b7d28762b45224e
SHA512591c31c302da6f803913574aa531822bbd4dbca7318e0ec65e86c030ec2303598bd6bcd2a6049c37e15824a756ad4628dc1bc136980a7925e8d869ffbe1d5145