Analysis
-
max time kernel
47s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 22:08
Behavioral task
behavioral1
Sample
84157a9bff0354b8e4945ad5787aa54acd671985352143e8c2d1f357fd874b78.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
84157a9bff0354b8e4945ad5787aa54acd671985352143e8c2d1f357fd874b78.xls
Resource
win10v2004-20241007-en
General
-
Target
84157a9bff0354b8e4945ad5787aa54acd671985352143e8c2d1f357fd874b78.xls
-
Size
30KB
-
MD5
b81aba42fc3aacf5e80df158a7a1cf19
-
SHA1
4adc8f129e819ba6afe70febee8792786cca500a
-
SHA256
84157a9bff0354b8e4945ad5787aa54acd671985352143e8c2d1f357fd874b78
-
SHA512
10be3e74dc91457ebfb4ef008c87a1e87d26e41a34ebab5f7c1b1ad89cd28b820c57666b29a62787fc5e45cb091e13e8c9549bba5845203a62394358582cb5d3
-
SSDEEP
768:VjlSFsv66g3KnF439NKC54kkGfn+cL2XdA87wruPh+tCQmX6H8:HSFsv66g3KnF439NKC54kkGfn+cL2Xd0
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4864 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE 4864 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\84157a9bff0354b8e4945ad5787aa54acd671985352143e8c2d1f357fd874b78.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4864