Analysis
-
max time kernel
47s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:10
Behavioral task
behavioral1
Sample
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
Resource
win10v2004-20240709-en
General
-
Target
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls
-
Size
126KB
-
MD5
d89dfeaadf6cdf2b7ea3435644180b3a
-
SHA1
bc9767d6217daba21cfdf8ed7e8dba01742bf196
-
SHA256
2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d
-
SHA512
928a0d467b79ba834f031e2a220c75e56017f7df7dba57be4a9ce274881f422683d70fdf39053c5f1496d1c59bb084fe6e8c0984d70b7740be49a1df631a560e
-
SSDEEP
1536:KdKcpx2Sk/8E3NEN1vn5jG685uUDf44fAg:8AxdEzvn5jb8cU
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4848 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5d851f0dbc7e5b69cfd0baadbba85157b
SHA1bc6c039ddfa536318b2df6f1f4e169566fb96035
SHA256b9433b156f97f210bfe887fb447fbc949099b59ad1d2a28e18435aab675c4879
SHA5122d4659e586d2188dcb514cc33a1afe03ec7d8c3cfaf1ddf788541e9f6a4a16c78e67897e9c289e5a7c5cb9e1957fd65ae2a64373e9ee33fdec5f2dda4f9c607d