b4fc5b365d6ccb4dc726a82c8b3f1c39ce16bf848c779706569c938d1a6855a8

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls
Size

1.1MB
MD5

5debb3535cba6615526c64e44d0f5e2b
SHA1

abaa744d9504c7f23a237f8220ac6a441016d518
SHA256

5bac7a020f173d6c35f73d76cd3745a36564dbb3dd32f2d5fc5021c353e76a54
SHA512

4435f4deebc2f03c3a5659d1a870699d22fdb52525829373cf3bc0592db04da967e14f1e3f001b1cc0b974f8bddb96887480bcb7f14f3172caba1382866676c0
SSDEEP

12288:/bkdb1vJu/xtIIcnIE9A3HfOoV+4qF2KhaLZA6H/EHagqNC9:TkdbVJupvSmHfOoaF2KhaLZTx89

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1788	4752	certutil.exe	89

Executes dropped EXE 1 IoCs

pid	Process
4860	Z4U8K1S8.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4752	EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE
4752	EXCEL.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 1788	4752	EXCEL.EXE	92
PID 4752 wrote to memory of 1788	4752	EXCEL.EXE	92
PID 4752 wrote to memory of 4860	4752	EXCEL.EXE	95
PID 4752 wrote to memory of 4860	4752	EXCEL.EXE	95
PID 4752 wrote to memory of 4860	4752	EXCEL.EXE	95

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\malware-sample-library-master\APT28 FancyBear\APT28DropperExcelDoc.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SYSTEM32\certutil.exe
  certutil -decode C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\T1U3H6N7.txt C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
  2⤵
  - Process spawned unexpected child process
  PID:1788
- C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
  2⤵
  - Executes dropped EXE
  PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\T1U3H6N7.txt

Filesize
691KB

MD5
1b330a7f7cc348ce408c10b64c79a5e8

SHA1
e82ee9c54b78df69404f3fa75f8a3f703b72cb70

SHA256
4e77c794ccd2cb3a0139ce07f70e170b15bc1e618ac6959797cec889048b5005

SHA512
7a077b90802e020edbd545ed5726f1339052422026d9f3438592c35099ce1b168a8d2d2a6f3845ecb6422f54f388611f53c013ddaec74182ab98b7bd6b35682e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe

Filesize
518KB

MD5
ba78410702f0cc8453da1afbb2a8b670

SHA1
1083245ac66d4261f526d18d4eac79a7dbd72989

SHA256
9f9e74241d59eccfe7040bfdcbbceacb374eda397cc53a4197b59e4f6f380a91

SHA512
7433785795c68faa74b2d34b734cf4c4564940fbe21cb9ddd6c0251378455a9ded4595055059d42b73e8cdbfe59f16b4b4d4100fcca94a440bb9520f4572f74b

Download Submit
memory/4752-29-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-17-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-2-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download
memory/4752-7-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download
memory/4752-8-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-9-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-10-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-6-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-1-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download
memory/4752-12-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-13-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-11-0x00007FF968F30000-0x00007FF968F40000-memory.dmp

Filesize
64KB

Download
memory/4752-14-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-15-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-16-0x00007FF968F30000-0x00007FF968F40000-memory.dmp

Filesize
64KB

Download
memory/4752-30-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-18-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-19-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-21-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-22-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-20-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-23-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-4-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download
memory/4752-0-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download
memory/4752-65-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-38-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-5-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-41-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-42-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-3-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-55-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-56-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-59-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-60-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-61-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-62-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-63-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-64-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-33-0x0000025C53AF0000-0x0000025C542F0000-memory.dmp

Filesize
8.0MB

Download
memory/4752-86-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download
memory/4752-89-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download
memory/4752-91-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-90-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-88-0x00007FF9AB1D0000-0x00007FF9AB3C5000-memory.dmp

Filesize
2.0MB

Download
memory/4752-87-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download
memory/4752-85-0x00007FF96B250000-0x00007FF96B260000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads