Overview
overview
3Static
static
3ASPjm-test.vbs
windows7-x64
1ASPjm-test.vbs
windows10-2004-x64
1ad-manage/...or.vbs
windows7-x64
1ad-manage/...or.vbs
windows10-2004-x64
1ad-manage/...tor.js
windows7-x64
1ad-manage/...tor.js
windows10-2004-x64
1ad-manage/...��.url
windows7-x64
1ad-manage/...��.url
windows10-2004-x64
1asp-lz/Code.vbs
windows7-x64
1asp-lz/Code.vbs
windows10-2004-x64
1config.vbs
windows7-x64
1config.vbs
windows10-2004-x64
1dbconn.vbs
windows7-x64
1dbconn.vbs
windows10-2004-x64
1department...ok.vbs
windows7-x64
1department...ok.vbs
windows10-2004-x64
1department...st.vbs
windows7-x64
1department...st.vbs
windows10-2004-x64
1dll/dc_dat..._0.dll
windows7-x64
1dll/dc_dat..._0.dll
windows10-2004-x64
1dll/jmail.dll
windows7-x64
1dll/jmail.dll
windows10-2004-x64
1dll/setup.bat
windows7-x64
1dll/setup.bat
windows10-2004-x64
1err/sql-err.html
windows7-x64
1err/sql-err.html
windows10-2004-x64
1excel/users_145.xls
windows7-x64
1excel/users_145.xls
windows10-2004-x64
1fckeditor_...mon.js
windows7-x64
1fckeditor_...mon.js
windows10-2004-x64
1fckeditor_...t.html
windows7-x64
1fckeditor_...t.html
windows10-2004-x64
1Analysis
-
max time kernel
101s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 18:29
Static task
static1
Behavioral task
behavioral1
Sample
ASPjm-test.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ASPjm-test.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
ad-manage/fckeditor.vbs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
ad-manage/fckeditor.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
ad-manage/fckeditor.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ad-manage/fckeditor.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
ad-manage/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ad-manage/新云软件.url
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
asp-lz/Code.vbs
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
asp-lz/Code.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
config.vbs
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
config.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
dbconn.vbs
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
dbconn.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
department/manage/Admin_user_ok.vbs
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
department/manage/Admin_user_ok.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
department/manage/admin_list.vbs
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
department/manage/admin_list.vbs
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
dll/dc_data100_v1_0.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
dll/dc_data100_v1_0.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
dll/jmail.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
dll/jmail.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
dll/setup.bat
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
dll/setup.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
err/sql-err.html
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
err/sql-err.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
excel/users_145.xls
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
excel/users_145.xls
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
fckeditor_2.6.2/editor/dialog/common/fck_dialog_common.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
fckeditor_2.6.2/editor/dialog/common/fck_dialog_common.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
fckeditor_2.6.2/editor/dialog/fck_about.html
Resource
win7-20240319-en
Behavioral task
behavioral32
Sample
fckeditor_2.6.2/editor/dialog/fck_about.html
Resource
win10v2004-20240412-en
General
-
Target
excel/users_145.xls
-
Size
95B
-
MD5
ab1d91af7ab99b51c1d8ac01904b0733
-
SHA1
d5f94290bfe8fca05f83503f55602852f46cc7b9
-
SHA256
74c30abf7a837d7850cf6d9c0ba00665e284c552b9695675c705785a2641f351
-
SHA512
fc414bf1bc767435d518896d2e0fb3866bea8296027708ac64d2b55a1abe471313883478e7a5f4487990ea9228b93363cae25e8de5dcbb8a87e874eb23497845
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2880 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE 2880 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\excel\users_145.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2880