87c74962ab990edc5ad94c3a83ca2a450ee25aa491edf5bbfd250af7c3e4cfcb

Resubmissions

02/08/2024, 06:28

240802-g8lvasvhpd 1

02/08/2024, 05:51

240802-gkc79ayhnp 5

Analysis

max time kernel
166s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240730-en
resource tags

arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
submitted
02/08/2024, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Electrical Boards Panels BoQ.xlsx
Size

35KB
MD5

555ed2ea533e0196d0e91005a951aa09
SHA1

e13b34f907df358d304be28fc0ce094e4bbda7db
SHA256

8bfaad49dd772f6426a923122a900ed70d46d9a850a81234799ce044b8967923
SHA512

5a970bee6d643a237f27dbcf03289aef274c2aaba8e3cd72c593993296cdf6fb7e8a74b29ab4c8c33f5c7cc494a208d9bc116a68ea4e9283dcb8e424f1269550
SSDEEP

768:t3eeobQOWWTpsgMHx3If4CSxH+mwXFuax:t3TobQTWtsgMRY4omi5

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1592	EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Electrical Boards Panels BoQ.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
691B

MD5
6eac951eb1f494feddf1f56af3065c8d

SHA1
2c9eedff6631464b9fe5a33647a0c9477fb73960

SHA256
b2a2ddb9defb0a11631ba303bda83a4b6e2de845b56458450c06271debaa181d

SHA512
4b3f86598bf9e0d978fa70f9f72bd3210c62bc9ca9f4eb65e2f4266fcc49173f33aff3a23ec2d3d228defa868ebce595302a5736d395c0b1f5f03a8395ed24fa

Download Submit
memory/1592-14-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-10-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-4-0x00007FFCDF703000-0x00007FFCDF704000-memory.dmp

Filesize
4KB

Download
memory/1592-3-0x00007FFC9F6F0000-0x00007FFC9F700000-memory.dmp

Filesize
64KB

Download
memory/1592-7-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-8-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-0-0x00007FFC9F6F0000-0x00007FFC9F700000-memory.dmp

Filesize
64KB

Download
memory/1592-9-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-6-0x00007FFC9F6F0000-0x00007FFC9F700000-memory.dmp

Filesize
64KB

Download
memory/1592-5-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-2-0x00007FFC9F6F0000-0x00007FFC9F700000-memory.dmp

Filesize
64KB

Download
memory/1592-12-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-20-0x00007FFC9D310000-0x00007FFC9D320000-memory.dmp

Filesize
64KB

Download
memory/1592-17-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-19-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-18-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-13-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-16-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-15-0x00007FFC9D310000-0x00007FFC9D320000-memory.dmp

Filesize
64KB

Download
memory/1592-11-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-1-0x00007FFC9F6F0000-0x00007FFC9F700000-memory.dmp

Filesize
64KB

Download
memory/1592-27-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-28-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download
memory/1592-29-0x00007FFCDF660000-0x00007FFCDF869000-memory.dmp

Filesize
2.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads