cea5afd13b92e129cb92104427d1d7915c5ccce1ba85ef314f2db1d6e115b456

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cea5afd13b92e129cb92104427d1d7915c5ccce1ba85ef314f2db1d6e115b456.xlam
Size

673KB
MD5

132a3570cc09c2e1e315e008004a0d1e
SHA1

3866bceec9cf288999c245fe6949b9d0ce42ca0b
SHA256

cea5afd13b92e129cb92104427d1d7915c5ccce1ba85ef314f2db1d6e115b456
SHA512

fa2a60743b3c4112fbccb1393b5d165520a8f12c7e664e070e70d16f9b0cf0eab586314506d16d9f80140c1f9cf411bcc8067beb6b78111ea23ca11a83e6a0fe
SSDEEP

12288:dZKLu8Y8imd6uYl3In1Ap9/GPpzDBcm86yUsMDbGjNgGcivN3h8f4Js:/KPY8TwDVm1k9/GdBurUNDghvj8P

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1784	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1784	EXCEL.EXE
1784	EXCEL.EXE
1784	EXCEL.EXE
1784	EXCEL.EXE
1784	EXCEL.EXE
1784	EXCEL.EXE
1784	EXCEL.EXE
1784	EXCEL.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\cea5afd13b92e129cb92104427d1d7915c5ccce1ba85ef314f2db1d6e115b456.xlam"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
0c1f9cdcf62bca1e37c54e648d0f818d

SHA1
a5d44febee73a51fea870fd2590901f39dcf7f67

SHA256
da3e8b0f4670fa8e86d4a8b490c112ea9e44acb91fd4f18cfac13623b8cb6683

SHA512
d813d4ec89b5e8937064c34370e006036320a28f058f13b3383f4e7c3477ef269f0e09e3eb5546990268addabbc07c548253c24ac38dc2f129bcec9f948ad075

Download Submit
memory/1784-11-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-1-0x00007FFBD6E4D000-0x00007FFBD6E4E000-memory.dmp

Filesize
4KB

Download
memory/1784-10-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-6-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-5-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-8-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

Filesize
64KB

Download
memory/1784-7-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-4-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

Filesize
64KB

Download
memory/1784-3-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

Filesize
64KB

Download
memory/1784-2-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

Filesize
64KB

Download
memory/1784-14-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-9-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-13-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-15-0x00007FFB94C70000-0x00007FFB94C80000-memory.dmp

Filesize
64KB

Download
memory/1784-12-0x00007FFB94C70000-0x00007FFB94C80000-memory.dmp

Filesize
64KB

Download
memory/1784-25-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-27-0x00007FFBD6DB0000-0x00007FFBD6FA5000-memory.dmp

Filesize
2.0MB

Download
memory/1784-26-0x00007FFBD6E4D000-0x00007FFBD6E4E000-memory.dmp

Filesize
4KB

Download
memory/1784-0-0x00007FFB96E30000-0x00007FFB96E40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads