b5e78357d97da35d95dcf61681d041c71bb939046d018cb8a02a510e0f1d00ad

Analysis

max time kernel
57s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5e78357d97da35d95dcf61681d041c71bb939046d018cb8a02a510e0f1d00ad.xls
Size

192KB
MD5

878ceaac71e9aa01e4e725653caaf916
SHA1

819bf4ef7e2d34bd9854da9523d67c6c538b2072
SHA256

b5e78357d97da35d95dcf61681d041c71bb939046d018cb8a02a510e0f1d00ad
SHA512

56d2ed308c36dafcbaf6ebcfebf2f84ebb54340d019a6e859141adec5be75abd2758e3269ce21d7f4286c1606d6c31d2246228597b4e8d25917dc4404199ce7f
SSDEEP

3072:H9XdpYkmZL4Zlt8D3676QpsaCqRK7bs/2Y6fL0/9Upyj6JJtG+2hEqqekWNL+9d6:9deLCmQ6QEsuJYVUpQP+2q0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2496	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE
2496	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b5e78357d97da35d95dcf61681d041c71bb939046d018cb8a02a510e0f1d00ad.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4508,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x00007FF925FB0000-0x00007FF925FC0000-memory.dmp

Filesize
64KB

Download
memory/2496-1-0x00007FF965FCD000-0x00007FF965FCE000-memory.dmp

Filesize
4KB

Download
memory/2496-3-0x00007FF925FB0000-0x00007FF925FC0000-memory.dmp

Filesize
64KB

Download
memory/2496-2-0x00007FF925FB0000-0x00007FF925FC0000-memory.dmp

Filesize
64KB

Download
memory/2496-6-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-5-0x00007FF925FB0000-0x00007FF925FC0000-memory.dmp

Filesize
64KB

Download
memory/2496-7-0x00007FF925FB0000-0x00007FF925FC0000-memory.dmp

Filesize
64KB

Download
memory/2496-10-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-11-0x00007FF923C00000-0x00007FF923C10000-memory.dmp

Filesize
64KB

Download
memory/2496-9-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-8-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-12-0x00007FF923C00000-0x00007FF923C10000-memory.dmp

Filesize
64KB

Download
memory/2496-4-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-14-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-17-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-19-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-18-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-16-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-15-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-13-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-38-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-37-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-45-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-54-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-55-0x00007FF965FCD000-0x00007FF965FCE000-memory.dmp

Filesize
4KB

Download
memory/2496-56-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-57-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-58-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-62-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download
memory/2496-63-0x00007FF965F30000-0x00007FF966125000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads