538445a2eda2847be72120bc476107a3dff6dda02e047f38c636228fc86138b6

Analysis

max time kernel
104s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Examples/Maximum Flow Example.xlsx
Size

13KB
MD5

7fe46b95889dfcd541eb2e417363c8f0
SHA1

d6637db07c0f2f775301224fd14449f3e3d9a56f
SHA256

4fa9e9ef6a18237213405ca10f435e9d01158c7d8cf729da1bb0a14821418030
SHA512

f08150e408503948771f0bfc68b2ce17f96f870af64b8a81791e3a7afe6299b4914a24186f82ad20f6acbd18af099b90d78f9ded1f40e79deffcd5a039b1a569
SSDEEP

192:RUje8C4pZewIJ6+T1E4FG+AId+GI9swoKFxzqgodq2wwst:CjE4XewIJPBtAV8KFE/Jst

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2060 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE
2060	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Examples\Maximum Flow Example.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize
2KB

MD5
c0db940f860edc7519cb7d64f459f092

SHA1
2404248e291047431afa8b1e768fdb4f1c50fae8

SHA256
8b8f62fe70bfdae929c69f0b66eecdb81a6e0a77fd77c6d09da2db0fe8871c66

SHA512
c404d1a6ab2e66ddf8c2e4e785debde5ee3a878bcdb48faabaf7741b21c8c5b9313af3366f700e81165274d23e0ead2de63c6103b7ea48aafc15418f628507ee

Download Submit
memory/2060-6-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-3-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-12-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-5-0x00007FFBD94CD000-0x00007FFBD94CE000-memory.dmp

Filesize
4KB

Download
memory/2060-4-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-9-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-8-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-7-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-13-0x00007FFB96CE0000-0x00007FFB96CF0000-memory.dmp

Filesize
64KB

Download
memory/2060-0-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-56-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-1-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-11-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-14-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-15-0x00007FFB96CE0000-0x00007FFB96CF0000-memory.dmp

Filesize
64KB

Download
memory/2060-2-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-35-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download
memory/2060-55-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-53-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-52-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-54-0x00007FFB994B0000-0x00007FFB994C0000-memory.dmp

Filesize
64KB

Download
memory/2060-10-0x00007FFBD9430000-0x00007FFBD9625000-memory.dmp

Filesize
2.0MB

Download