Analysis
-
max time kernel
133s -
max time network
129s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
31-10-2024 09:46
Static task
static1
Behavioral task
behavioral1
Sample
malware.xlsx
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
malware.xlsx
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
malware.xlsx
Resource
win11-20241007-en
General
-
Target
malware.xlsx
-
Size
2.2MB
-
MD5
af4a015e14731aca9d5d89d18b6145a5
-
SHA1
d43b9773c95cf3c7b0db3bf7d7571ea57db88898
-
SHA256
d54bdc32e63a1159d8775046e4ac77bd96a6745c29049effea5303a37e2d865a
-
SHA512
9629b2bffe3761bb7a9c5a31dc229f46f42a111825eb1c17a880228ae76a9ebd708e9c274661211dc82c436cf0de8ff0b6f1da45960e9f21c29a8e70ce24c774
-
SSDEEP
49152:Jp1keRzwrg87vtJer92x2zUkW2AhynUOAgLhouLDDeccF51Q:Jsm387XdkSPkNfJ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4636 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE 4636 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\malware.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5b7d45043b9ae20a2e2a85497ce4ebf44
SHA17387414966a5cc10f4da90f748e603185cd90262
SHA25614862b3f634d43a012fe121c75cdd5e115883a0884424e40186fd3bce6042f76
SHA512e307bbabfde7f6a64f154b51cb5c336936e90d0db7a3a045a2b5fadd61e556429c75fbace183abc44276ebc3769e23f3168766d5df10e6093f9947a651441165