Overview
overview
10Static
static
1000ab8a1a2b...51.doc
windows7-x64
300ab8a1a2b...51.doc
windows10-2004-x64
104bbbaf0d0...25.exe
windows7-x64
304bbbaf0d0...25.exe
windows10-2004-x64
31139a9099f...64.exe
windows7-x64
31139a9099f...64.exe
windows10-2004-x64
3114a8c03ee...39.doc
windows7-x64
4114a8c03ee...39.doc
windows10-2004-x64
119911c6865...fc.exe
windows7-x64
19911c6865...fc.exe
windows10-2004-x64
2299ff9c7e...6.docx
windows7-x64
42299ff9c7e...6.docx
windows10-2004-x64
12b79b44b0f...07.dll
windows7-x64
52b79b44b0f...07.dll
windows10-2004-x64
52c6638998f...2a.xls
windows7-x64
32c6638998f...2a.xls
windows10-2004-x64
135352a7ac7...ce.exe
windows7-x64
35352a7ac7...ce.exe
windows10-2004-x64
3792408618...3f.xls
windows7-x64
33792408618...3f.xls
windows10-2004-x64
13b0fd96950...ea.dll
windows7-x64
53b0fd96950...ea.dll
windows10-2004-x64
54078c6d0ff...f7.lnk
windows7-x64
34078c6d0ff...f7.lnk
windows10-2004-x64
7428f4ed31c...99.dll
windows7-x64
1428f4ed31c...99.dll
windows10-2004-x64
14c27f9a78c...04.ps1
windows7-x64
34c27f9a78c...04.ps1
windows10-2004-x64
34d9f557790...24.exe
windows7-x64
74d9f557790...24.exe
windows10-2004-x64
74f7848518a...6d.doc
windows7-x64
34f7848518a...6d.doc
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2024 18:16
Behavioral task
behavioral1
Sample
00ab8a1a2bfa99a92e0cacaaf1e7ca1af6c8cc0eab6f070f157ec9c2d7f03a51.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00ab8a1a2bfa99a92e0cacaaf1e7ca1af6c8cc0eab6f070f157ec9c2d7f03a51.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
04bbbaf0d059bb09a2e44a3dbadb391a2f5aab5bfef5718fa3e8198502d0eb25.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
04bbbaf0d059bb09a2e44a3dbadb391a2f5aab5bfef5718fa3e8198502d0eb25.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
1139a9099f0424b533a49c8bc4ac5d569e67db11ff5fd02c8552a3461db7ba64.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
1139a9099f0424b533a49c8bc4ac5d569e67db11ff5fd02c8552a3461db7ba64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139.doc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
19911c686578bafabd45a1e491333f1e0bc5eac5f6b1db29aa913dfd3dd207fc.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
19911c686578bafabd45a1e491333f1e0bc5eac5f6b1db29aa913dfd3dd207fc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6.docx
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a.xls
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
35352a7ac72a7962744268c134b1aacaba3eccd700e5c1378b4c13cf08d353ce.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
35352a7ac72a7962744268c134b1aacaba3eccd700e5c1378b4c13cf08d353ce.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
3792408618099db73b654704b12c9520d3267c37e50bf9718c2877ec2e65133f.xls
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
3792408618099db73b654704b12c9520d3267c37e50bf9718c2877ec2e65133f.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
3b0fd96950336e30d3586c719ad802d89668276fbc7d7209c8d8bf4e59eb6bea.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
3b0fd96950336e30d3586c719ad802d89668276fbc7d7209c8d8bf4e59eb6bea.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7.lnk
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
4078c6d0ff9e7acc63c49589d0bc171ce3f2c913bee1bb7bf972e9068f8759f7.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
428f4ed31c02b75f45bb328fd1d8e207a1160a02f1b77f17b30098c4d1cb0299.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
428f4ed31c02b75f45bb328fd1d8e207a1160a02f1b77f17b30098c4d1cb0299.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
4c27f9a78ca18364a6a42b5c61f94442782afef7fcc6a1cdfa9efc09b514cd04.ps1
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
4c27f9a78ca18364a6a42b5c61f94442782afef7fcc6a1cdfa9efc09b514cd04.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
4d9f557790e63bccbca6fbc20a47661e15869004db64412196b8756025ea1f24.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
4d9f557790e63bccbca6fbc20a47661e15869004db64412196b8756025ea1f24.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
4f7848518acd8847a6fc4f87ca7a20ef502641426ae1bb1353df989a8edc076d.doc
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
4f7848518acd8847a6fc4f87ca7a20ef502641426ae1bb1353df989a8edc076d.doc
Resource
win10v2004-20241007-en
General
-
Target
2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a.xls
-
Size
47KB
-
MD5
f3f09fe500641b53376cbda5449a693f
-
SHA1
83ea735e83004d74e960d496f540d3e70731222c
-
SHA256
2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a
-
SHA512
2e03f3547c0a212b3905549ddb397246aa21f3edecefc83f10d5232c91ea1fc0d4e5d5aa9e7705236f4a0b6d7373e64ac2f4c5424829136d1ca63eaa4d1b21da
-
SSDEEP
768:mI88aOO/SfOT+XPACr1D30jw+c+MhyCmwyaIDOVc5:hO/SWT+XPlD30jsVeN1D
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1444 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1444 EXCEL.EXE 1444 EXCEL.EXE 1444 EXCEL.EXE 1444 EXCEL.EXE 1444 EXCEL.EXE 1444 EXCEL.EXE 1444 EXCEL.EXE 1444 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2c6638998faca3866c5a12d851381d37f2aebedb299c720ce4dffa09c5e1e52a.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1444