Overview
overview
10Static
static
3setfsb/Creator.xls
windows7-x64
3setfsb/Creator.xls
windows10-2004-x64
1setfsb/WinRing0.dll
windows7-x64
3setfsb/WinRing0.dll
windows10-2004-x64
3setfsb/WinRing0.sys
windows7-x64
1setfsb/WinRing0.sys
windows10-2004-x64
1setfsb/Win...64.sys
windows7-x64
1setfsb/Win...64.sys
windows10-2004-x64
1setfsb/setfsb.exe
windows7-x64
10setfsb/setfsb.exe
windows10-2004-x64
10Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 17:39
Static task
static1
Behavioral task
behavioral1
Sample
setfsb/Creator.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
setfsb/Creator.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
setfsb/WinRing0.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
setfsb/WinRing0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
setfsb/WinRing0.sys
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
setfsb/WinRing0.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
setfsb/WinRing0x64.sys
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
setfsb/WinRing0x64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
setfsb/setfsb.exe
Resource
win7-20240903-en
General
-
Target
setfsb/Creator.xls
-
Size
53KB
-
MD5
5d3c5f9fe4ca09cebc0386abf47031c0
-
SHA1
03bb80a37dee81c216f0925c7d6746538c1c0f49
-
SHA256
f10cc8c2807378b4e60b330011e50cb58a2cebc2763e51ebf0c3de8a8d96a1a4
-
SHA512
7b4e513f6803cbb532a6e106e9c9c29fbb2e0d836c2fb0472b3e8281501e776801569bbdd5a6668d9ba3c9070fb78ec059ba8fa79bbce54784c32c5fcf3f8082
-
SSDEEP
1536:PJTv0zKq8cMeXJFLUqOFN3bYmlL/rhclIN:lOKqYyFLU/FxbYmlL/rSlIN
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2212 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE 2212 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\setfsb\Creator.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2212