Overview
overview
10Static
static
3malware-sa...er.zip
windows7-x64
1malware-sa...er.zip
windows10-2004-x64
18200755cbe...33.exe
windows7-x64
88200755cbe...33.exe
windows10-2004-x64
829c7e87350...5b.exe
windows7-x64
129c7e87350...5b.exe
windows10-2004-x64
149cccd30a5...90.exe
windows7-x64
149cccd30a5...90.exe
windows10-2004-x64
9b17911ddea...82.exe
windows7-x64
1b17911ddea...82.exe
windows10-2004-x64
102ca4397da...51.exe
windows7-x64
102ca4397da...51.exe
windows10-2004-x64
1022aeb126d...74.exe
windows7-x64
9022aeb126d...74.exe
windows10-2004-x64
9smb-7teux2sm.exe
windows7-x64
9smb-7teux2sm.exe
windows10-2004-x64
9smb-onil0o36.exe
windows7-x64
9smb-onil0o36.exe
windows10-2004-x64
9malware-sa...ab.exe
windows7-x64
10malware-sa...ab.exe
windows10-2004-x64
10malware-sa...1).exe
windows7-x64
6malware-sa...1).exe
windows10-2004-x64
6malware-sa...n.xlsx
windows7-x64
1malware-sa...n.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
571s -
max time network
575s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
malware-samples-master.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
malware-samples-master.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
smb-7teux2sm.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
smb-7teux2sm.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
smb-onil0o36.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
smb-onil0o36.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win10v2004-20240226-en
General
-
Target
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
-
Size
14KB
-
MD5
248cd700a82449f4b0d107e6a934ae2b
-
SHA1
d1763d827d614ddd6f3ca046ec6d1cf880f4dc25
-
SHA256
6ff88255226a7f0de338e8383904a6fd8af5eb630c28ae6846b107de41fa22ef
-
SHA512
c5755cc015b3e6aa30ce1c87c05a7712fc7939f57d7d470025a50c8d280ad53d97701f34b85b8f9300652989720915ccac28a22925e73ea48455116f37c31746
-
SSDEEP
384:YlbZERmunyjfOOTXC6ACMYMx3pF5dBwDVfJZKTvazDpzQ:OdunyXXC6jzqTKVxZ7zDC
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3596 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE 3596 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\malware-samples-master\mitre-attack\Emotet+Trickbot_comparison.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3596