70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a

Analysis

max time kernel
135s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a.xlam
Size

611KB
MD5

33befe584a0a8e659e29c8ce5129f61f
SHA1

32236fd8f2c9d1b62e4633c72bbe5c38107d56c8
SHA256

70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a
SHA512

61d19eddddeee6fe0c63a3671be572ab76fa29b137fac326981f420575c3235034320fc50f2f25c77254f2190b5d8d1373137e54235e7700c4d2428f3b8c604d
SSDEEP

12288:P8BiIRAbnhLSkFsU9qjGLD00o36LAto7eDwUB1m0SN0C1TGcbDMasYGHI:0rMt4m1+o0+0Sn1TTQqGHI

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1984	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\70cbb6ca45c4d23bfd817fc0a822b7907f281ae01602fcedbf5cc7e634f8422a.xlam"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
59e50405f15803f48e26661ae6b320e6

SHA1
807f6dcf8f7de8e9dec00ccc38fabff1b8fce9bc

SHA256
241640d4ccb2703b4563af6b054e4589931d5ee5ce50006de6276eb2d17702ff

SHA512
c69542e14944b644814c7f0f9ba986c7f8cb7a4a655274ae497c9300d6989d3b2cb9084aa85754a87282ae022247e8f41c445aa83615742111de6f1061c750ff

Download Submit
memory/1984-11-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-0-0x00007FF835550000-0x00007FF835560000-memory.dmp

Filesize
64KB

Download
memory/1984-9-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-8-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-7-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-13-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-14-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-17-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-3-0x00007FF87556D000-0x00007FF87556E000-memory.dmp

Filesize
4KB

Download
memory/1984-4-0x00007FF835550000-0x00007FF835560000-memory.dmp

Filesize
64KB

Download
memory/1984-15-0x00007FF833460000-0x00007FF833470000-memory.dmp

Filesize
64KB

Download
memory/1984-18-0x00007FF833460000-0x00007FF833470000-memory.dmp

Filesize
64KB

Download
memory/1984-16-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-10-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-6-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-5-0x00007FF835550000-0x00007FF835560000-memory.dmp

Filesize
64KB

Download
memory/1984-1-0x00007FF835550000-0x00007FF835560000-memory.dmp

Filesize
64KB

Download
memory/1984-2-0x00007FF835550000-0x00007FF835560000-memory.dmp

Filesize
64KB

Download
memory/1984-30-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download
memory/1984-12-0x00007FF8754D0000-0x00007FF8756C5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads