Analysis
-
max time kernel
46s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 21:24
Behavioral task
behavioral1
Sample
fa45c51259c93ebb9b35bf7df6c3a30644353dccc8c9c232553bd5a4d742da36.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa45c51259c93ebb9b35bf7df6c3a30644353dccc8c9c232553bd5a4d742da36.xlsm
Resource
win10v2004-20241007-en
General
-
Target
fa45c51259c93ebb9b35bf7df6c3a30644353dccc8c9c232553bd5a4d742da36.xlsm
-
Size
92KB
-
MD5
190de4f0f62119e75eebb2cac1b0e018
-
SHA1
dd0e52be0ff8ee3273ea4a41270af50cac6e723c
-
SHA256
fa45c51259c93ebb9b35bf7df6c3a30644353dccc8c9c232553bd5a4d742da36
-
SHA512
3b6e7c35ee65954c0106c5cbbdb6dda15dd2f31b117b118d21d7fa0f312e6ca95396438848db3bb2504bbe6a3d0edd4852c9410b9a45b8b18e44d03f892f323b
-
SSDEEP
1536:CguZCa6S5khUIyJLx/dQl4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIbFz:CgugapkhlyJ9/aaPjpM+d/Ms8ULavLci
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2468 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE 2468 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fa45c51259c93ebb9b35bf7df6c3a30644353dccc8c9c232553bd5a4d742da36.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2468