Overview
overview
4Static
static
4Матер...я.zip
windows7-x64
1Матер...я.zip
windows10-2004-x64
1DjvuReader_2.0.exe
windows7-x64
3DjvuReader_2.0.exe
windows10-2004-x64
3Матер...и.xls
windows7-x64
3Матер...и.xls
windows10-2004-x64
1�...�.xlsm
windows7-x64
3�...�.xlsm
windows10-2004-x64
1windows7-x64
3windows10-2004-x64
3�...1.xlsx
windows7-x64
3�...1.xlsx
windows10-2004-x64
1�...2.xlsx
windows7-x64
3�...2.xlsx
windows10-2004-x64
1�...3.xlsx
windows7-x64
3�...3.xlsx
windows10-2004-x64
1�...4.xlsx
windows7-x64
3�...4.xlsx
windows10-2004-x64
1�...�.xlsx
windows7-x64
3�...�.xlsx
windows10-2004-x64
1�...�.xlsx
windows7-x64
3�...�.xlsx
windows10-2004-x64
1�...�.xlsx
windows7-x64
3�...�.xlsx
windows10-2004-x64
1�...1.xlsx
windows7-x64
3�...1.xlsx
windows10-2004-x64
1�...2.xlsx
windows7-x64
3�...2.xlsx
windows10-2004-x64
1�...3.xlsx
windows7-x64
3�...3.xlsx
windows10-2004-x64
1�...4.xlsx
windows7-x64
3�...4.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 06:03
Behavioral task
behavioral1
Sample
Материал для обучения.zip
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Материал для обучения.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
DjvuReader_2.0.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
DjvuReader_2.0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Материал\Горячие клавиши.xls
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Материал\Горячие клавиши.xls
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ਠ/Excel_ । .xlsm
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
ਠ/Excel_ । .xlsm
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ਠ/稥 .pdf
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
ਠ/稥 .pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ਠ/譥 1.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
ਠ/譥 1.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ਠ/譥 2.xlsx
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
ਠ/譥 2.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ਠ/譥 3.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
ਠ/譥 3.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ਠ/譥 4.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
ਠ/譥 4.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
ਠ/ .xlsx
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
ਠ/ .xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
ਠ/ 襭.xlsx
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
ਠ/ 襭.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
ਠ/᪨ 㭪樨.xlsx
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
ਠ/᪨ 㭪樨.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
ਠ/ 1.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
ਠ/ 1.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
ਠ/ 2.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
ਠ/ 2.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
ਠ/ 3.xlsx
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
ਠ/ 3.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
ਠ/ 4.xlsx
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
ਠ/ 4.xlsx
Resource
win10v2004-20240802-en
General
-
Target
ਠ/譥 1.xlsx
-
Size
83KB
-
MD5
a8d8f91965786ebb8c4fa77d8f5c462b
-
SHA1
80140af3808977d0a17e3750e306e851d76cb794
-
SHA256
63915c361859a0d70661d031dc9f19f97cf75fe7ed98ccd8d4a3978e6e396412
-
SHA512
0797bb3e78e9e820e399ce5ae667c69e8bdbc9229587140f5a4a8333de9fbde4a500bbca7ad72f4cd9e0b4f322e033753a08a573e6ce4751b8ff118fbe8f5695
-
SSDEEP
1536:x3WIkM/5yv+wBEgWtNrbk0uMeZy7Iv3H2bk+dH7LKgtGV:x3Wixyv+mExtNFuPveLHtGV
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4180 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE 4180 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ਠ\譥 1.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5ca6e07cebe4961194d584ed61da64970
SHA120a4bbacdba5ee3baaaf515ae2f2ba37cb1f8f04
SHA256d3e540fdc171de14b0958c5bba61630823e14e017c4c7ec8da0ee250a1d530ed
SHA51277d390d5b468602e502b24431d5e7a0cbb18df02fc2be7ac5d71908e5a86bf68b475f6cda414960d34f802acc25bb022b8c547d078f934cc9d45faf12fbe7ea3