538445a2eda2847be72120bc476107a3dff6dda02e047f38c636228fc86138b6

Analysis

max time kernel
84s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Examples/Standard Linear Example.xlsx
Size

12KB
MD5

621576701e4c97b98a8198bd926a8594
SHA1

96671b265590e21ba92cf8a64b8ac934b05fd6c9
SHA256

d88b663aa3772c7dfb920e760ee233c25010b9fef5bb604b8d29f133b3c3b51f
SHA512

f277561cdebbc17518192e4d1c9e8e5429525e5dd49170d2495613e35217b1d5cc1926ed64085fa5efe4a5e7eea4f7db0287f893551daeb62aad6254fb7ee6ad
SSDEEP

192:RUSdFA8mIJ6+ThTB8TM2N9qqFYpYYwbaVmFi68J6gT:CSdgIJPF98TM2qqFyKtqJ6gT

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1336 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Examples\Standard Linear Example.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
4KB

MD5
20d16ab8ac991908d670066bde05bd9a

SHA1
71bec10265c2eea991f912aded3a2e018e96c2ac

SHA256
a883653e82b9ee7ec4a7cec7a92f266d1948f668c2942961f68cb2e96f0f5a55

SHA512
ee81c2541341e8eecd7047947f3b0d52a304faa93c84e91606c87c8dfc33da178cfa424377fe3402df9de645fa8749f921f33014b7a7afc25f2017915644011a

Download Submit
memory/1336-6-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-5-0x00007FFCA7AD0000-0x00007FFCA7AE0000-memory.dmp

Filesize
64KB

Download
memory/1336-13-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-4-0x00007FFCE7AED000-0x00007FFCE7AEE000-memory.dmp

Filesize
4KB

Download
memory/1336-14-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-10-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-9-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-18-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-7-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-11-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-12-0x00007FFCA5170000-0x00007FFCA5180000-memory.dmp

Filesize
64KB

Download
memory/1336-0-0x00007FFCA7AD0000-0x00007FFCA7AE0000-memory.dmp

Filesize
64KB

Download
memory/1336-3-0x00007FFCA7AD0000-0x00007FFCA7AE0000-memory.dmp

Filesize
64KB

Download
memory/1336-1-0x00007FFCA7AD0000-0x00007FFCA7AE0000-memory.dmp

Filesize
64KB

Download
memory/1336-8-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-16-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-17-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-19-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-20-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-23-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-22-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-21-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download
memory/1336-15-0x00007FFCA5170000-0x00007FFCA5180000-memory.dmp

Filesize
64KB

Download
memory/1336-2-0x00007FFCA7AD0000-0x00007FFCA7AE0000-memory.dmp

Filesize
64KB

Download
memory/1336-41-0x00007FFCE7A50000-0x00007FFCE7C45000-memory.dmp

Filesize
2.0MB

Download