7c3c2152f63380c81f911edac7a9876c4f53cf4ce48fb3e992ef0fad32aa6821

Resubmissions

12/09/2024, 09:13

240912-k6p1qazhmc6

12/09/2024, 09:08

240912-k4c85szgrp7

12/09/2024, 09:05

240912-k2nxvszgpk3

12/09/2024, 08:49

240912-kqzj8azelj3

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
649884-CYP-TCK-EBL-CF-1040393H1E-M-24-08-00-01.csv
Size 718B
Sample240912-k2nxvszgpk
SHA256 7c3c2152f63380c81f911edac7a9876c4f53cf4ce48fb3e992ef0fad32aa6821
MD5 5e7a43943b7006dbdc7be3a34f1a14b1
SHA1 1f26bd43e186ceeb952530cc00ef1c4f2c617f16
SHA512 bcfc013fc0c537593562a1033482fef33e54d02e8b9bef898208922aaf7465fc09eed0b14f013525fe289ffd9c3d2baa35ec03272d1416798c46d5ad879d851d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000025986631100557365727300640009000400efbe874f77482c59c4482e000000c70500000000010000000000000000003a000000000061e4b30055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000000259526e100041646d696e003c0009000400efbe025986632c59c4482e0000007fe10100000001000000000000000000000000000000663b0a01410064006d0069006e00000014000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "3"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000003452f66fd7e4da0164947b3ef304db01d4f67d3ef304db0114000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e80922b16d365937a46956b92703aca08af260001002600efbe110000003452f66fd7e4da01e753b03bf304db014b10d74cf304db0114000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4520	EXCEL.EXE
3300	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3300	EXCEL.EXE
3300	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	EXCEL.EXE

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
4520	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE
3300	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\649884-CYP-TCK-EBL-CF-1040393H1E-M-24-08-00-01.csv"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1020,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:8
1⤵
PID:788

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Excel.CampaignStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json
Size 21B
SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
MD5 f1b59332b953b3c99b3c95a44249c0d2
SHA1 1b16a2ca32bf8481e18ff8b7365229b598908991
SHA512 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
MD5 SHA1 SHA512

Submit Download

Excel.GovernedChannelStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.GovernedChannelStates.json
Size 417B
SHA256 200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
MD5 c56ff60fbd601e84edd5a0ff1010d584
SHA1 342abb130dabeacde1d8ced806d67a3aef00a749
SHA512 acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e
MD5 SHA1 SHA512

Submit Download

Excel.Settings.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json
Size 87B
SHA256 6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
MD5 e4e83f8123e9740b8aa3c3dfa77c1c04
SHA1 5281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA512 bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9
MD5 SHA1 SHA512

Submit Download

Excel.SurveyEventActivityStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyEventActivityStats.json
Size 14B
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
MD5 SHA1 SHA512

Submit Download

223F0DC6-FA4F-40B5-82A7-F1E9BF9C8DE3

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\223F0DC6-FA4F-40B5-82A7-F1E9BF9C8DE3
Size 397B
SHA256 57d6315a8f1f11aaa111a9956ddd0d560f791f757c379ed77bbb5a1b5b577f52
MD5 2f82426450332b558a61ae9ca551abd9
SHA1 abdbf8f8bdd7572bcdefbd1e0b7da8d3cf17144d
SHA512 dbc43dab6cbde98647c5a88cd508a1528ef79c030286cf82cb4cb03c4af81930ad1c3b2644ead9eceea27cd5772324f42a51f04f1693102254567205a6abf0b5
MD5 SHA1 SHA512

Submit Download

82F2F50F-CADC-400B-BA7B-7C28DAEE3CEE

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\82F2F50F-CADC-400B-BA7B-7C28DAEE3CEE
Size 1KB
SHA256 2fb3e7ca57b5ec8657ff2b909c74dee246e7ed2b30abd60dec96fc4fb88bd165
MD5 85ad173999ed440af6120f3b4fd436fa
SHA1 eebe3bae40b0c82db581b905e2a4c4a90055c9b3
SHA512 3c506252a27bc4a3d718fc2ad89036850ee3c9d5fd79966fc5e28debe1844d96e8d2777e160e8537034129fd8109dff027bf5eb4a082c99d0db93730ec31427e
MD5 SHA1 SHA512

Submit Download

62BC7498-6167-4F31-9223-CCDDBFC0DC7C

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\62BC7498-6167-4F31-9223-CCDDBFC0DC7C
Size 170KB
SHA256 9e75ac81b425e6b128f171ba6d0f76c117a009a7f98ee059fb9ef3664c63cc01
MD5 59132752ff321d464082a7f8cf797603
SHA1 7948a36b2f2354ab460e5a734185d7ac48a652be
SHA512 10bd0fbcabd6b0d0677db0f72452e91a4c3e5688872b6c3efd567aceb7af40877ec75f6132ea5eb54d1278d6cc575969c15426e992c0dee3516ae6a7fb97cdfe
SSDEEP 1536:Xi2XPRAqXbH41gwEpLe7HW8bM/hMYcAZl1p5ihs7EXXBEAD2Odac:T5e7HW8bM/kXWkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 320KB
SHA256 c72ac8cb5ac91290357dd9c931f52757bd17d6792cc0b6cda581e4f97d72f035
MD5 1860cdd48aea9511bbd598c3d6e80ec2
SHA1 4d80fb389297d1b42330fc9cc043890b7de843ef
SHA512 64718fa5631271dd34463b67d7c95c87ffa80f914f61d2dfd2b33262ad9e7aaa8e3ba5ec6b53e39c8eea8a8baa0b0364dfa0954d1192ab483e07dc1f8a5485e5
SSDEEP 1536:42/zod+LU6KPh1u6uSivsUQK75IthKoLr2Xu8:V3U6KPh1u6uSivsUQK75IthCXV
MD5 SHA1 SHA512 SSDEEP

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 11KB
SHA256 76217e974936144ca38b4de2bd3cade68339a3a23eb25c49f18ea70a762c18f4
MD5 bae11dd0f5cc1a5ec67c1d8d9bd18590
SHA1 3317632c30f987cd827c1f3fa2cd48ab03c5c9f3
SHA512 c0ec54d2f68a4165e63e320641bf3912c2dbb1cc82bc950259b8664670ea524d41349c6f0d589af31090390c50b15e8ea03477ecd20288974f45898c5885b8f5
SSDEEP 192:hjG89ZZzN/ZMmjZpPp9uPfzGAZJpKJLRj2E9MwzK2Zv3p5jbZ98Dze8ZF0:nZKf0L2w7pyDw
MD5 SHA1 SHA512 SSDEEP

Submit Download

excel.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db
Size 24KB
SHA256 b8411fe8ec499074fca9047f6983d920279e84ddf3b02b2dd5c08cf07ec44687
MD5 085ebd119f5fc6b8f63720fac1166ff5
SHA1 af066018aadec31b8e70a124a158736aca897306
SHA512 adb0522830db26123347cb485c43b156f5c888510e52091ba0fafc22b650ad29630c027746c920321905c28259dce7ff63dded93a79efddd5567c68312117875
SSDEEP 12:TgeywqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TTqt8VtbDBtDi4kZERDEe
MD5 SHA1 SHA512 SSDEEP

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 68d7b8a31f554265a31627f49f9f7b770c4f8bf8e8719b4e1c926fa6112dd11a
MD5 a1401f74101020b5a72604b3bd68ebf0
SHA1 14e3c82bed535bc92d8ef2ff396a84df4e933a71
SHA512 bd1cdf5c65ba98b1f1da4ff8ac4376c982428e03186d710591ad0980818c49015eb8bd40f0da2e10f1e225adb64327f0c811eaae7adb72b4b87a6ce1c601efe5
MD5 SHA1 SHA512

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 09866de5be98c538f21b382499530f331c4f9977a3db1435818bac4929ebfc48
MD5 b3fa2b816d1177e06b2436d13ef2f6a4
SHA1 b27299ad7b395cb821648ed30763b9cdaf235d9d
SHA512 615f451e81c4d2ad59a27976b98673af558939617cb9a467f7550f6a15e1d56d6f097f0317e0d527f9f9427df9da48e11f6510b53dcba45ecd6bd1d60e3c3d8e
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 401B
SHA256 c5b666979df3ec67b5939ec0537ff2ce5e0053f8938136986af8025300b81815
MD5 8b6bd4ae3125e84f074f45235fa36ebf
SHA1 9207e25bea052e46f37716580687991a4ebaa990
SHA512 432c7bff0303bdc7af3db28a0f15a19260d0639aba49e685f2323a4d157252dfc7b362ae488f57e4a1d2c54b14db8d1a534564dd4c906c952d8f3138ca56b45c
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 bb984ca45b1dd42bf5ed286ea99dbe2b1c8c857db2ea7b309dd591e3f7fca5ba
MD5 82156cca0a2ef34b314db112844414fe
SHA1 8e8b7d8a3d2b08e4fd0d5b0fbe4b037c4f6ae51b
SHA512 d6821cd0653e7b2ff9bbcbcbcea9c5e56d3554a1fb0c4f7a1db96b3dbf764305b35a3bdeead7a1d73c4f7ad5aeb2eb38ab29ab0fa6f5c344fe81b30e0f32fef2
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 89db7a6631113134734df0793513cbdff988cf02079433a93b8162b5bd0ebec3
MD5 fc336af3f082b3c53f96b51c2fac93bd
SHA1 3541ea5923ab7c26e002fea537dc291a5515294c
SHA512 538df06a28f27580f080eec2830727b4f9616de343b4c7fafc49c3432a025468539a8e595f9daa0d8cd755293fc7afc40e2f394d9decaf96c2c073f4eaaf8aeb
MD5 SHA1 SHA512

Submit Download

649884-CYP-TCK-EBL-CF-1040393H1E-M-24-08-00-01.csv

Path C:\Users\Admin\Desktop\649884-CYP-TCK-EBL-CF-1040393H1E-M-24-08-00-01.csv
Size 721B
SHA256 541eb3a98083712ce5994f9a9096dad80a4426439198ddbbf17922fc8827c1a1
MD5 2408ef65e56140292f515c2ffb705101
SHA1 180c6c5813931c4de8c994f1d12547cc8e38a662
SHA512 ebb82c7695b860cff94c94c5f9b456d3ea52bda880f76e2dfc40c08306853231acfe2745c7a890c9f4ebc5e5f5df13253353f72a7b804450e5d03bec01de3ee1
MD5 SHA1 SHA512

Submit Download

memory/3300-108-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/3300-135-0x0000020DF05D0000-0x0000020DF0772000-memory.dmp

Download

memory/3300-151-0x0000020DF15C0000-0x0000020DF1AE8000-memory.dmp

Download

memory/3300-150-0x0000020DD67B0000-0x0000020DD680A000-memory.dmp

Download

memory/3300-149-0x0000020DD65D0000-0x0000020DD65E8000-memory.dmp

Download

memory/3300-148-0x0000020DD3BF0000-0x0000020DD3C00000-memory.dmp

Download

memory/3300-147-0x0000020DD6760000-0x0000020DD67B0000-memory.dmp

Download

memory/3300-146-0x0000020DD6690000-0x0000020DD66B8000-memory.dmp

Download

memory/3300-145-0x0000020DF9F60000-0x0000020DFE276000-memory.dmp

Download

memory/3300-144-0x0000020DD6600000-0x0000020DD6622000-memory.dmp

Download

memory/3300-143-0x0000020DD64A0000-0x0000020DD64AA000-memory.dmp

Download

memory/3300-142-0x0000020DD3BE0000-0x0000020DD3BF0000-memory.dmp

Download

memory/3300-141-0x0000020DF1C20000-0x0000020DF29B0000-memory.dmp

Download

memory/3300-140-0x0000020DD61B0000-0x0000020DD61D2000-memory.dmp

Download

memory/3300-139-0x0000020DF0CC0000-0x0000020DF0E82000-memory.dmp

Download

memory/3300-138-0x0000020DD6630000-0x0000020DD668C000-memory.dmp

Download

memory/3300-109-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/3300-137-0x0000020DF0A20000-0x0000020DF0CB4000-memory.dmp

Download

memory/3300-110-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/3300-107-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/3300-111-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/3300-112-0x00007FF841B90000-0x00007FF841BA0000-memory.dmp

Download

memory/3300-136-0x0000020DF31E0000-0x0000020DF5C40000-memory.dmp

Download

memory/3300-114-0x00007FF841B90000-0x00007FF841BA0000-memory.dmp

Download

memory/4520-104-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/4520-106-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-15-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-14-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-12-0x00007FF841B90000-0x00007FF841BA0000-memory.dmp

Download

memory/4520-10-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-11-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-9-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-6-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-3-0x00007FF883CAD000-0x00007FF883CAE000-memory.dmp

Download

memory/4520-17-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-20-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-5-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/4520-16-0x00007FF841B90000-0x00007FF841BA0000-memory.dmp

Download

memory/4520-103-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/4520-4-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/4520-105-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/4520-102-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/4520-19-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-18-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-13-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-8-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-7-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-30-0x00007FF883C10000-0x00007FF883E05000-memory.dmp

Download

memory/4520-1-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/4520-0-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download

memory/4520-2-0x00007FF843C90000-0x00007FF843CA0000-memory.dmp

Download