70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a

Analysis

max time kernel
46s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a.xlam
Size

611KB
MD5

33befe584a0a8e659e29c8ce5129f61f
SHA1

32236fd8f2c9d1b62e4633c72bbe5c38107d56c8
SHA256

70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a
SHA512

61d19eddddeee6fe0c63a3671be572ab76fa29b137fac326981f420575c3235034320fc50f2f25c77254f2190b5d8d1373137e54235e7700c4d2428f3b8c604d
SSDEEP

12288:P8BiIRAbnhLSkFsU9qjGLD00o36LAto7eDwUB1m0SN0C1TGcbDMasYGHI:0rMt4m1+o0+0Sn1TTQqGHI

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2832	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2832	EXCEL.EXE
2832	EXCEL.EXE
2832	EXCEL.EXE
2832	EXCEL.EXE
2832	EXCEL.EXE
2832	EXCEL.EXE
2832	EXCEL.EXE
2832	EXCEL.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a.xlam"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
edf5c711a14cbe4d75f8499cf159bb25

SHA1
0453fc5a9ffb87a9353d180ff74ee0cfe7334617

SHA256
c921ef30704cdd703f86f45efa001a72c51b707a920e9b8551b4f0619bee30c3

SHA512
620a7c6b72a4af8b4bc75aab366c5815cf33df275cbdd1b30a09e0d9e3f433bd27e05c5af537399daa50cb85d14bfd294bcaf703a6af1bae944795056b6bcbfd

Download Submit
memory/2832-13-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-18-0x00007FFA429ED000-0x00007FFA429EE000-memory.dmp

Filesize
4KB

Download
memory/2832-2-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

Filesize
64KB

Download
memory/2832-4-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

Filesize
64KB

Download
memory/2832-10-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-9-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-11-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-14-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-1-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

Filesize
64KB

Download
memory/2832-0-0x00007FFA429ED000-0x00007FFA429EE000-memory.dmp

Filesize
4KB

Download
memory/2832-8-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-7-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-6-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-15-0x00007FFA00170000-0x00007FFA00180000-memory.dmp

Filesize
64KB

Download
memory/2832-5-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

Filesize
64KB

Download
memory/2832-16-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-17-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-3-0x00007FFA029D0000-0x00007FFA029E0000-memory.dmp

Filesize
64KB

Download
memory/2832-19-0x00007FFA42950000-0x00007FFA42B45000-memory.dmp

Filesize
2.0MB

Download
memory/2832-12-0x00007FFA00170000-0x00007FFA00180000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads