ce21d34bafe338effb8f619936f057084cb45743fce884a1465966d8523a00a8

Resubmissions

31/03/2024, 20:03

240331-yspppaag518

31/03/2024, 19:57

240331-ypkxbsbc438

Analysis

max time kernel
109s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.vbs
Size 35KB
Sample240331-ypkxbsbc43
SHA256 ce21d34bafe338effb8f619936f057084cb45743fce884a1465966d8523a00a8
MD5 3f0b1eed4b7b9ae05fab4d949843f103
SHA1 e5b9fa0a23f337adae93ed4e8fcd1e9d9db4acba
SHA512 292183a9d0b3e5759453a43bcf34b8b1d09d09523687bfab090dd740a5c70169938904949b1c5a025b40082898dc3ec240ad2ec788b66f256efe5a041f774740
SSDEEP 384:3+WbqwPv/ETzbVwNY/+TU5lHizK+BS3DzxW8M2GzraAzVCIXh3aM:OWbqm/EvZwO2TUrEQDtI2G31lX5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000230bd29ecc68da01e2fcada1cc68da01cffd34a3cc68da0114000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4364	EXCEL.EXE
4100	EXCEL.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE
4100	EXCEL.EXE

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.vbs"
1⤵
PID:2644

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4364

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 471B
SHA256 53b09a96e8b430c2189b41da7c270ea4215e7ffda7fb3380c24ee64f7a367183
MD5 36f75533a18e65452cb5a5f5c5a9842c
SHA1 7fb7bcbcdfbdaef6cf94998ea5ed791a58bcf14b
SHA512 fc3dbdbf8e2dbfc33431adc993993cce9caab4d13331b2d98d591d59d59bd6516ad33a8178d9cef83e9bf2fb5986851281215be4b472b86a80a6c05c86942bc8
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 412B
SHA256 afd8b95f4c445ec20dfc7487d1ae54b48fa191550bef6ef9aab91644a1b62294
MD5 4b028eb716d49a9d089757676818a738
SHA1 efc71cccabc662ba8569cf3b2309b8002215f135
SHA512 c13e6e082129f4a4ae2e6537ea92effa4e9c79d79dd7dac3492fafabf6caaaeecf24a82321f1728e1d6c37daeddec583fa7cce4d747e9d0f6a96da787846fd34
MD5 SHA1 SHA512

Submit Download

E1929F02-5300-41A1-95B5-26D695E3D45A

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E1929F02-5300-41A1-95B5-26D695E3D45A
Size 160KB
SHA256 26973f1eda6ff40dfc4bd4bda3392ffc8330f017647af6b50be110d76748dd69
MD5 2a52139a3486a5b0a7ce93318a10fe5d
SHA1 689d9fd605e64b2aaaabb01037b0d23b1f389174
SHA512 8166940be395d183b93d99133bf3f7a783ab48a1a6691521af7276532aa4619fff482b3b9140ddf5665eb72abb26709abd0143be562ddb452e40410fae4fb5fc
SSDEEP 1536:9+C7FPgOXB3U9guw/JQ9DQA+z1Qik4F77nXmvYd8XRTEwreOR6g:7BQ9DQA+zGXeMJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TenantInfo.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml
Size 76B
SHA256 385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
MD5 0f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1 242755226012b4449a49b45491c0b1538ebf6410
SHA512 a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
MD5 SHA1 SHA512

Submit Download

excel.exe.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
Size 48KB
SHA256 ffb4b25485870fddf4e865181272e1564cba9b9286516cd904679fb6e52a59cc
MD5 e199690069190286bd36e3cd2add6de5
SHA1 623e980403ffa83771bf9c3c52032049da28fa70
SHA512 85a4f510cae7404ff189ca28d0d8367e20e79e8722b7b95f151a34d83abc6fcfbfeacca473e2f2966236c49d2fe5eff003836384b97d29497643959f5901c990
SSDEEP 48:j7Q0Q1GhUll7DYMkzO8VFDYMUdDO8VFDYML:343ll4XjVGrpjVGC
MD5 SHA1 SHA512 SSDEEP

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 daaf004e88510542f7803804526e78b4a553b0a4709ab06355ec06066b09931e
MD5 ef4cd011b6a94818ad413ba238ae6f3c
SHA1 64e4035457eb41562af356c014e7755782601cd1
SHA512 cdc88337b7c6d26de76216edf367dd8bef27812f1736932229904ef461abb60047880a73c5568a122a710f5ce97bbec94317ee992877cad4793755b8b4b22d37
MD5 SHA1 SHA512

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 17db5e4c4f3c2003572279cfe67e408187029f98edaaa8384a2dc3791cf7f342
MD5 1687b21afa25cfc12c459d3136f4c3fb
SHA1 f85e5d6fdf83d1d0dd0636bdd2ec9fa57ca531f2
SHA512 36b862e59486a3fcdc2d721d9adb28c1bcdaf4bea0400df20a19786c6c04beb2f931d08fd94fb9b713c90e12c6574b3fb5f96a774ed74dfbc41e01c7a3b96e94
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 234B
SHA256 35e3be6f6d51faf78eb94e664e12703c7d6bc05faf0428dca1e9a6f5eac5e375
MD5 e7157d66e60b2e8b1ce138f219c73b04
SHA1 2b0a598bd8c7ab5619a82dce08b0e9de93f2c248
SHA512 1e6ce3be57985521aa6545e6c1c99ba9a14cff00b157cb1b02e5761d685b5ce71d18cc22e59fca318f44770c8b98dd148f3816172f4441637a70a0417e71189a
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 24B
SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
MD5 4fcb2a3ee025e4a10d21e1b154873fe2
SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
MD5 SHA1 SHA512

Submit Download

Book1.xlsx

Path C:\Users\Admin\Desktop\Book1.xlsx
Size 8KB
SHA256 e3b8bf2154c1dc116cffe94c73885f9ddd0111f930da00380e494f7767c31d71
MD5 497159f83c6dc1794c4f087df7e60855
SHA1 4848f66653d6d66c0a81a9919068989e2788f61f
SHA512 f48d0b6dc094dfc2dac459dec38434627a8f68f90678216b5a9d175d82a727ff91ee8d9cdf02bf51fa52e906ec571033eea5d09f2f7bc25346abb3d6e145e929
SSDEEP 192:wc8mVUFOiJb3U2hAyaFUlbVvevUqzQXpS05aok:wc3KFBB3rEUlM9z6pxaok
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4100-60-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-66-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-130-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-129-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-128-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-127-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-126-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-125-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-85-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-52-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-55-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-54-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-53-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-56-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-57-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-59-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-84-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-58-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4100-61-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-62-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-63-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-64-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-65-0x00007FF8587C0000-0x00007FF8587D0000-memory.dmp

Download

memory/4100-83-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-67-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4100-69-0x00007FF8587C0000-0x00007FF8587D0000-memory.dmp

Download

memory/4364-11-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-51-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-8-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-0-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4364-6-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-5-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4364-4-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4364-3-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-9-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-10-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-7-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4364-1-0x00007FF85A870000-0x00007FF85A880000-memory.dmp

Download

memory/4364-2-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-16-0x00007FF8587C0000-0x00007FF8587D0000-memory.dmp

Download

memory/4364-17-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-15-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-12-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-14-0x00007FF89A7F0000-0x00007FF89A9E5000-memory.dmp

Download

memory/4364-13-0x00007FF8587C0000-0x00007FF8587D0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads