Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2024 01:31
Behavioral task
behavioral1
Sample
ae077a49b9c64042bfec4c08c90696191ebf0cde63b8a2fb8a470ebe73427ced.xls
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ae077a49b9c64042bfec4c08c90696191ebf0cde63b8a2fb8a470ebe73427ced.xls
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
ae077a49b9c64042bfec4c08c90696191ebf0cde63b8a2fb8a470ebe73427ced.xls
-
Size
92KB
-
MD5
8da737e5f973809a7ae6ddc039777635
-
SHA1
5d11137d7ee9cd56f2b97732fb95f1c60290ddf6
-
SHA256
ae077a49b9c64042bfec4c08c90696191ebf0cde63b8a2fb8a470ebe73427ced
-
SHA512
e089b0e9cf4e05536713f22b33b54c2e92e73fd5bf6bfc87623b394bf1584170ab3065aaa3b0b31d826e0ab783d0ad110c8f7fb1223331a345c785c0d79bc457
-
SSDEEP
1536:QcKoSsxz1PDZL2Qiw+4868O8K/5Le1k3hOdsylKlgxopeiBNhZFGzE+cL2kdAlIj:QcKoSsxzNDZL2Qiw+4868O8K/5Le1k34
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 24 IoCs
flow pid Process 6 1948 msiexec.exe 31 1948 msiexec.exe 35 1948 msiexec.exe 41 1948 msiexec.exe 46 1948 msiexec.exe 58 1948 msiexec.exe 64 1948 msiexec.exe 65 1948 msiexec.exe 66 1948 msiexec.exe 67 1948 msiexec.exe 73 1948 msiexec.exe 74 1948 msiexec.exe 75 1948 msiexec.exe 76 1948 msiexec.exe 79 1948 msiexec.exe 80 1948 msiexec.exe 81 1948 msiexec.exe 82 1948 msiexec.exe 83 1948 msiexec.exe 84 1948 msiexec.exe 85 1948 msiexec.exe 86 1948 msiexec.exe 87 1948 msiexec.exe 88 1948 msiexec.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4612 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4612 EXCEL.EXE Token: SeIncreaseQuotaPrivilege 4612 EXCEL.EXE Token: SeSecurityPrivilege 1948 msiexec.exe Token: SeCreateTokenPrivilege 4612 EXCEL.EXE Token: SeAssignPrimaryTokenPrivilege 4612 EXCEL.EXE Token: SeLockMemoryPrivilege 4612 EXCEL.EXE Token: SeIncreaseQuotaPrivilege 4612 EXCEL.EXE Token: SeMachineAccountPrivilege 4612 EXCEL.EXE Token: SeTcbPrivilege 4612 EXCEL.EXE Token: SeSecurityPrivilege 4612 EXCEL.EXE Token: SeTakeOwnershipPrivilege 4612 EXCEL.EXE Token: SeLoadDriverPrivilege 4612 EXCEL.EXE Token: SeSystemProfilePrivilege 4612 EXCEL.EXE Token: SeSystemtimePrivilege 4612 EXCEL.EXE Token: SeProfSingleProcessPrivilege 4612 EXCEL.EXE Token: SeIncBasePriorityPrivilege 4612 EXCEL.EXE Token: SeCreatePagefilePrivilege 4612 EXCEL.EXE Token: SeCreatePermanentPrivilege 4612 EXCEL.EXE Token: SeBackupPrivilege 4612 EXCEL.EXE Token: SeRestorePrivilege 4612 EXCEL.EXE Token: SeShutdownPrivilege 4612 EXCEL.EXE Token: SeDebugPrivilege 4612 EXCEL.EXE Token: SeAuditPrivilege 4612 EXCEL.EXE Token: SeSystemEnvironmentPrivilege 4612 EXCEL.EXE Token: SeChangeNotifyPrivilege 4612 EXCEL.EXE Token: SeRemoteShutdownPrivilege 4612 EXCEL.EXE Token: SeUndockPrivilege 4612 EXCEL.EXE Token: SeSyncAgentPrivilege 4612 EXCEL.EXE Token: SeEnableDelegationPrivilege 4612 EXCEL.EXE Token: SeManageVolumePrivilege 4612 EXCEL.EXE Token: SeImpersonatePrivilege 4612 EXCEL.EXE Token: SeCreateGlobalPrivilege 4612 EXCEL.EXE Token: SeShutdownPrivilege 4612 EXCEL.EXE Token: SeIncreaseQuotaPrivilege 4612 EXCEL.EXE Token: SeCreateTokenPrivilege 4612 EXCEL.EXE Token: SeAssignPrimaryTokenPrivilege 4612 EXCEL.EXE Token: SeLockMemoryPrivilege 4612 EXCEL.EXE Token: SeIncreaseQuotaPrivilege 4612 EXCEL.EXE Token: SeMachineAccountPrivilege 4612 EXCEL.EXE Token: SeTcbPrivilege 4612 EXCEL.EXE Token: SeSecurityPrivilege 4612 EXCEL.EXE Token: SeTakeOwnershipPrivilege 4612 EXCEL.EXE Token: SeLoadDriverPrivilege 4612 EXCEL.EXE Token: SeSystemProfilePrivilege 4612 EXCEL.EXE Token: SeSystemtimePrivilege 4612 EXCEL.EXE Token: SeProfSingleProcessPrivilege 4612 EXCEL.EXE Token: SeIncBasePriorityPrivilege 4612 EXCEL.EXE Token: SeCreatePagefilePrivilege 4612 EXCEL.EXE Token: SeCreatePermanentPrivilege 4612 EXCEL.EXE Token: SeBackupPrivilege 4612 EXCEL.EXE Token: SeRestorePrivilege 4612 EXCEL.EXE Token: SeShutdownPrivilege 4612 EXCEL.EXE Token: SeDebugPrivilege 4612 EXCEL.EXE Token: SeAuditPrivilege 4612 EXCEL.EXE Token: SeSystemEnvironmentPrivilege 4612 EXCEL.EXE Token: SeChangeNotifyPrivilege 4612 EXCEL.EXE Token: SeRemoteShutdownPrivilege 4612 EXCEL.EXE Token: SeUndockPrivilege 4612 EXCEL.EXE Token: SeSyncAgentPrivilege 4612 EXCEL.EXE Token: SeEnableDelegationPrivilege 4612 EXCEL.EXE Token: SeManageVolumePrivilege 4612 EXCEL.EXE Token: SeImpersonatePrivilege 4612 EXCEL.EXE Token: SeCreateGlobalPrivilege 4612 EXCEL.EXE Token: SeShutdownPrivilege 4612 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE 4612 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ae077a49b9c64042bfec4c08c90696191ebf0cde63b8a2fb8a470ebe73427ced.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4612
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1948