Overview
overview
3Static
static
3BNG/Chenie...3.xlsx
windows7-x64
1BNG/Chenie...3.xlsx
windows10-2004-x64
1Commercial...re.pdf
windows7-x64
1Commercial...re.pdf
windows10-2004-x64
1Commercial...re.pdf
windows7-x64
1Commercial...re.pdf
windows10-2004-x64
1Commercial...re.pdf
windows7-x64
1Commercial...re.pdf
windows10-2004-x64
1Commercial...re.pdf
windows7-x64
1Commercial...re.pdf
windows10-2004-x64
1Commercial...re.pdf
windows7-x64
1Commercial...re.pdf
windows10-2004-x64
1Commercial...re.pdf
windows7-x64
1Commercial...re.pdf
windows10-2004-x64
1Commercial...-1.pdf
windows7-x64
1Commercial...-1.pdf
windows10-2004-x64
1Commercial...ce.pdf
windows7-x64
1Commercial...ce.pdf
windows10-2004-x64
1Fire Water...1.xlsx
windows7-x64
1Fire Water...1.xlsx
windows10-2004-x64
1Paddle, Bl...P.xlsx
windows7-x64
1Paddle, Bl...P.xlsx
windows10-2004-x64
1Paddle, Bl...s.xlsx
windows7-x64
1Paddle, Bl...s.xlsx
windows10-2004-x64
1Paddle, Bl...-4.pdf
windows7-x64
1Paddle, Bl...-4.pdf
windows10-2004-x64
1Paddle, Bl...-4.pdf
windows7-x64
1Paddle, Bl...-4.pdf
windows10-2004-x64
1Paddle, Bl...-4.pdf
windows7-x64
1Paddle, Bl...-4.pdf
windows10-2004-x64
1Paddle, Bl...-4.pdf
windows7-x64
1Paddle, Bl...-4.pdf
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 11:59
Behavioral task
behavioral1
Sample
BNG/Cheniere AML Rev. 3.xlsx
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
BNG/Cheniere AML Rev. 3.xlsx
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Commercial Docs/COW - Confined Space Entry Permitting Procedure.pdf
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Commercial Docs/COW - Confined Space Entry Permitting Procedure.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Commercial Docs/COW - Energized Electrical Work Permitting Procedure.pdf
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Commercial Docs/COW - Energized Electrical Work Permitting Procedure.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
Commercial Docs/COW - Energy Isolation Permitting Procedure.pdf
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Commercial Docs/COW - Energy Isolation Permitting Procedure.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
Commercial Docs/COW - Excavation and Trenching Permitting Procedure.pdf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Commercial Docs/COW - Excavation and Trenching Permitting Procedure.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
Commercial Docs/COW - Lifting Operations Permitting Procedure.pdf
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Commercial Docs/COW - Lifting Operations Permitting Procedure.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Commercial Docs/COW - Permit to Work Procedure.pdf
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
Commercial Docs/COW - Permit to Work Procedure.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
Commercial Docs/Cheniere Prevailing Wage Labor Study - Heavy-1.pdf
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Commercial Docs/Cheniere Prevailing Wage Labor Study - Heavy-1.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
Commercial Docs/Simultaneous Operations SIMOPS - Safe Work Practice.pdf
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Commercial Docs/Simultaneous Operations SIMOPS - Safe Work Practice.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
Fire Water Specialties RFP/Cheniere AML Rev. 3-1.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Fire Water Specialties RFP/Cheniere AML Rev. 3-1.xlsx
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Paddle, Blanks and Spacers/Cheniere SP CO2 FEED - Paddles Blanks and Spacers RFP.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Paddle, Blanks and Spacers/Cheniere SP CO2 FEED - Paddles Blanks and Spacers RFP.xlsx
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
Paddle, Blanks and Spacers/Specials - Paddles and Specs.xlsx
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
Paddle, Blanks and Spacers/Specials - Paddles and Specs.xlsx
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
Paddle, Blanks and Spacers/Tech Specs/A2A_Rev00B-4.pdf
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Paddle, Blanks and Spacers/Tech Specs/A2A_Rev00B-4.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
Paddle, Blanks and Spacers/Tech Specs/A3_Rev00B-4.pdf
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Paddle, Blanks and Spacers/Tech Specs/A3_Rev00B-4.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
Paddle, Blanks and Spacers/Tech Specs/A5_Rev00B-4.pdf
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
Paddle, Blanks and Spacers/Tech Specs/A5_Rev00B-4.pdf
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
Paddle, Blanks and Spacers/Tech Specs/B1A_Rev00B-4.pdf
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Paddle, Blanks and Spacers/Tech Specs/B1A_Rev00B-4.pdf
Resource
win10v2004-20240226-en
General
-
Target
Paddle, Blanks and Spacers/Specials - Paddles and Specs.xlsx
-
Size
93KB
-
MD5
3b9f5dc761ede1f096b09afa2ff5580e
-
SHA1
44be8ecba9fc401ad889d07ad7a541dd6c960493
-
SHA256
620431cb3b1073df779894c64bbfad548ecd4fe0b8c7f1155003c9e561195450
-
SHA512
7ef41b8e5f6dba6d3d8776b46bb090cc2b1139c77f234f1fa345e7d41a4e9b2122c31f2ea2dc985e947b8e6f5c7069ffb324257ddd18577218c583489ee4a2ee
-
SSDEEP
1536:2eItsNVuxvRCP3GAyq8qHS+snjVSkIXtOqsFHVl4r7r8bKeuIGESzyaE1KQv/lbY:2iu5RCP3G+jHSrnjEkIzsVVl4rX7Iwzf
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4712 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE 4712 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Paddle, Blanks and Spacers\Specials - Paddles and Specs.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4712-0-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-1-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-3-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-2-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-6-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-5-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-4-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-7-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-8-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-9-0x00007FF873CB0000-0x00007FF873CC0000-memory.dmpFilesize
64KB
-
memory/4712-10-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-11-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-12-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-13-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-15-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-14-0x00007FF873CB0000-0x00007FF873CC0000-memory.dmpFilesize
64KB
-
memory/4712-16-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-17-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-18-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-19-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-21-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-20-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-22-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-23-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-38-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-55-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-56-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-57-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-59-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-60-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB
-
memory/4712-58-0x00007FF876010000-0x00007FF876020000-memory.dmpFilesize
64KB
-
memory/4712-61-0x00007FF8B5F90000-0x00007FF8B6185000-memory.dmpFilesize
2.0MB