Analysis
-
max time kernel
47s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 21:52
Behavioral task
behavioral1
Sample
d391c43cf92e851dedad1c7f7ff2df861b58702015aa8118ed35bf901f00e16a.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d391c43cf92e851dedad1c7f7ff2df861b58702015aa8118ed35bf901f00e16a.xlsm
Resource
win10v2004-20240802-en
General
-
Target
d391c43cf92e851dedad1c7f7ff2df861b58702015aa8118ed35bf901f00e16a.xlsm
-
Size
92KB
-
MD5
2eae62461752d8cfd8b0fb1d324c11e4
-
SHA1
2ac7396abc0baff861020f045c390e657c49689a
-
SHA256
d391c43cf92e851dedad1c7f7ff2df861b58702015aa8118ed35bf901f00e16a
-
SHA512
b94d0c3922413fa90f61250bbde9d58726298a03801c8d045f0ddae666a4b7404f6d1fd797c4f23e04dd67cadf54ee2192c184b429345795a7255cd2a02b04d6
-
SSDEEP
1536:CguZCa6S5khUIisLV6UJl9WXDYVOI4znOSjhLqxMUH9Ga/M1NIpPkUlB7583fjn+:CgugapkhlL6+9WXDYVDaPjpqxvD/Ms8Q
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2024 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE 2024 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d391c43cf92e851dedad1c7f7ff2df861b58702015aa8118ed35bf901f00e16a.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize2KB
MD570d8fb78a2e65fda0c1642ee18623131
SHA10eba7065dcbd9fd4aa5af7d8d45ecf45dd2bc742
SHA256ce135664ecc165904b5cc66544a0fb9495fc5a46f072803a4adf900ec494d978
SHA5123eb1c46be55bef4d9fa70d932f86dd187a3278d7d736a1a60c12a84d0dbef5c01de3942d86d735ae948754fd8c80a0860886201e49c068c41a88d01b350b25ff