fce8892fdbfb512b7bfb936d4eef5891b682f6d00419183b5e0fb7ea6acd680d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fce8892fdbfb512b7bfb936d4eef5891b682f6d00419183b5e0fb7ea6acd680d.xlsx
Size

31KB
MD5

503815dc63abe261247f600c61bfb909
SHA1

c8d05b44edd40b6be74dad475177cc991c716f60
SHA256

fce8892fdbfb512b7bfb936d4eef5891b682f6d00419183b5e0fb7ea6acd680d
SHA512

a3ac5325604a8f881db977e96bd9baf59b52c73ac2cdbea1bc2140a452f4552d4e5eca9e55b2c74a7c5db4fc8be0a8dc542c6b01327345b47a63e12d8a0ae574
SSDEEP

768:PSrWXBPFCio+RHwB8RGf1/yCFqgTNWVFrqERs1kpzZsFByx:PI+9CioVgGf1/jqkW3hth6FB6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2068	EXCEL.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2068	EXCEL.EXE
2068	EXCEL.EXE
2068	EXCEL.EXE
2068	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\fce8892fdbfb512b7bfb936d4eef5891b682f6d00419183b5e0fb7ea6acd680d.xlsx
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~$fce8892fdbfb512b7bfb936d4eef5891b682f6d00419183b5e0fb7ea6acd680d.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
memory/2068-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2068-1-0x000000007266D000-0x0000000072678000-memory.dmp

Filesize
44KB

Download
memory/2068-10-0x000000007266D000-0x0000000072678000-memory.dmp

Filesize
44KB

Download