Overview
overview
10Static
static
1001d63645f4...e3.exe
windows7-x64
901d63645f4...e3.exe
windows10-2004-x64
1014bae02cc3...0e.exe
windows7-x64
1014bae02cc3...0e.exe
windows10-2004-x64
8TNT Origin...ce.exe
windows7-x64
10TNT Origin...ce.exe
windows10-2004-x64
10402ff605d7...97.exe
windows7-x64
10402ff605d7...97.exe
windows10-2004-x64
104d0dfae91f...bf.exe
windows7-x64
74d0dfae91f...bf.exe
windows10-2004-x64
75401a3332d...8e.exe
windows7-x64
105401a3332d...8e.exe
windows10-2004-x64
10Autoit3.exe
windows7-x64
3Autoit3.exe
windows10-2004-x64
36cfe745f03...d2.exe
windows7-x64
106cfe745f03...d2.exe
windows10-2004-x64
1090f19e1a78...ef.exe
windows7-x64
790f19e1a78...ef.exe
windows10-2004-x64
1a3eeef65c4...4.xlsx
windows7-x64
1a3eeef65c4...4.xlsx
windows10-2004-x64
1a71829e150...e5.exe
windows7-x64
7a71829e150...e5.exe
windows10-2004-x64
7db58eb7713...c4.exe
windows7-x64
10db58eb7713...c4.exe
windows10-2004-x64
7Analysis
-
max time kernel
103s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 14:00
Behavioral task
behavioral1
Sample
01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01d63645f4c648e12fa693ecc9a926eda29ca031c5d067c687ee65cab67e74e3.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
14bae02cc31e4fb13f02aa594d65a977f1fdec305089c415985e11903769ae0e.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
14bae02cc31e4fb13f02aa594d65a977f1fdec305089c415985e11903769ae0e.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
TNT Original Invoice.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
TNT Original Invoice.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
402ff605d7f23f20e253e13b8cb1eb7b5b763a00311deba3cf13c9646ae1f397.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
402ff605d7f23f20e253e13b8cb1eb7b5b763a00311deba3cf13c9646ae1f397.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
4d0dfae91fed3f9273356eae54dae047b51e374034fd7e8c1e50066c24add6bf.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
4d0dfae91fed3f9273356eae54dae047b51e374034fd7e8c1e50066c24add6bf.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
5401a3332d6bf674b3a25eb23745edd09f943284aa4448f9eb6c53620027f28e.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
5401a3332d6bf674b3a25eb23745edd09f943284aa4448f9eb6c53620027f28e.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
Autoit3.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Autoit3.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
6cfe745f03252b83604bf8159f4100e402af25444247e697165c96e2e12f58d2.exe
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
6cfe745f03252b83604bf8159f4100e402af25444247e697165c96e2e12f58d2.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
90f19e1a7843dbee63856899da664d073c2b8fadd0cad368e623d5f7426ba5ef.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
a3eeef65c42890fd372bc7c627b36d2b9d54a909b809663e0f0392fa34766794.xlsx
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
a3eeef65c42890fd372bc7c627b36d2b9d54a909b809663e0f0392fa34766794.xlsx
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
a71829e150536a415790ed3f8897daab1da879adef2366f75ec939ec0e749de5.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
a71829e150536a415790ed3f8897daab1da879adef2366f75ec939ec0e749de5.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
db58eb77136d0a35453f949a25df9a2e0d344b389a136f966a1ec2c3c09ef2c4.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
db58eb77136d0a35453f949a25df9a2e0d344b389a136f966a1ec2c3c09ef2c4.exe
Resource
win10v2004-20240226-en
General
-
Target
a3eeef65c42890fd372bc7c627b36d2b9d54a909b809663e0f0392fa34766794.xlsx
-
Size
51KB
-
MD5
a30b624fcf50d488e0c251e14c838c19
-
SHA1
d15e6e8cb2fa067141a8f7f11bef9ee3167c3cca
-
SHA256
a3eeef65c42890fd372bc7c627b36d2b9d54a909b809663e0f0392fa34766794
-
SHA512
5d0bf22a204529fd13ae63d96a66391e0d8da4ff1d3cfd12125aeb35226b42a9854eb2f7b43ffecbd7a0dff37c793d620aa3dda8ba43d9ab8608247f09708a14
-
SSDEEP
1536:YYZDHgM8v42wkYq84lKL7IAnA4xCQH140t:YYZcMetF8T7IAA4xprt
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4188 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a3eeef65c42890fd372bc7c627b36d2b9d54a909b809663e0f0392fa34766794.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4188