70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_86576546576.xlam
Size

611KB
MD5

33befe584a0a8e659e29c8ce5129f61f
SHA1

32236fd8f2c9d1b62e4633c72bbe5c38107d56c8
SHA256

70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a
SHA512

61d19eddddeee6fe0c63a3671be572ab76fa29b137fac326981f420575c3235034320fc50f2f25c77254f2190b5d8d1373137e54235e7700c4d2428f3b8c604d
SSDEEP

12288:P8BiIRAbnhLSkFsU9qjGLD00o36LAto7eDwUB1m0SN0C1TGcbDMasYGHI:0rMt4m1+o0+0Sn1TTQqGHI

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3712	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3712	EXCEL.EXE
3712	EXCEL.EXE
3712	EXCEL.EXE
3712	EXCEL.EXE
3712	EXCEL.EXE
3712	EXCEL.EXE
3712	EXCEL.EXE
3712	EXCEL.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\_86576546576.xlam"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
5efa851829487634be8de879f703c56e

SHA1
a38d8c90c2b867c69e99ce43ddddc6f58f48c81a

SHA256
d8f0228738e1c1fcaa473df9095fbc239100db176a17c1b19a65eb24ecc80e3a

SHA512
fcf54669edf322bc27aa9b3d27bed8ddcbef84f77c22e751f183bfd2b3d2bcff5b954002c7e2de6d1aa3ebbb0365a8c461305782347b618c736c549682679511

Download Submit
memory/3712-12-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-32-0x00007FF834ACD000-0x00007FF834ACE000-memory.dmp

Filesize
4KB

Download
memory/3712-2-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

Filesize
64KB

Download
memory/3712-5-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

Filesize
64KB

Download
memory/3712-10-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-9-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-8-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-7-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-11-0x00007FF7F22A0000-0x00007FF7F22B0000-memory.dmp

Filesize
64KB

Download
memory/3712-6-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-1-0x00007FF834ACD000-0x00007FF834ACE000-memory.dmp

Filesize
4KB

Download
memory/3712-3-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

Filesize
64KB

Download
memory/3712-15-0x00007FF7F22A0000-0x00007FF7F22B0000-memory.dmp

Filesize
64KB

Download
memory/3712-14-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-13-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-18-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-17-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-19-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-16-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-31-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-33-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-0-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

Filesize
64KB

Download
memory/3712-34-0x00007FF834A30000-0x00007FF834C25000-memory.dmp

Filesize
2.0MB

Download
memory/3712-4-0x00007FF7F4AB0000-0x00007FF7F4AC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads