5e45c73a32cab5efa7196095c8842acb4ba13ce974e96f8190dd6ad0dd819f1e

Analysis

max time kernel
48s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e45c73a32cab5efa7196095c8842acb4ba13ce974e96f8190dd6ad0dd819f1e.xlsx
Size

2.2MB
MD5

dcd0d55f67330db999c89471cd01aa8f
SHA1

d994c44da5b32cdbf51917de57ed78968feaa639
SHA256

5e45c73a32cab5efa7196095c8842acb4ba13ce974e96f8190dd6ad0dd819f1e
SHA512

36da20e927fe523e6926a41efad0052a37e706a6f934c3e9495b0b2764ae179e2027c72e81919a037a71ce4b99063c6b20b929f57a182111726968085954bf00
SSDEEP

49152:4xfNNNNNNrv7RQKckqaI4WOhyHaAdAVG4dM3aQSsyhgKm7PXiQsWpdC:0VTeaIEocV7gCHmKkq/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
2088	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	Process
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5e45c73a32cab5efa7196095c8842acb4ba13ce974e96f8190dd6ad0dd819f1e.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
4KB

MD5
36c7e85fb21646ff8abd2bd3d4040268

SHA1
ed57afd192cfb12d6333725b206061fba770fd93

SHA256
a87c61e3caa41f0f13aa777c654ab46f919f4fa16c1bc4be187d3959590e0692

SHA512
afc1b3b0c1d86ea0d8a77c56aaaa3be3255deb9aa31e23a362078cde1d0742fe9006d8be7a12c743936aff908d409864eecf3d23fa1a164ffdca98e693d7fe49

Download Submit
memory/2088-13-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-1-0x00007FFF183CD000-0x00007FFF183CE000-memory.dmp

Filesize
4KB

Download
memory/2088-12-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-2-0x00007FFED83B0000-0x00007FFED83C0000-memory.dmp

Filesize
64KB

Download
memory/2088-5-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-6-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-10-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-9-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-8-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-14-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-4-0x00007FFED83B0000-0x00007FFED83C0000-memory.dmp

Filesize
64KB

Download
memory/2088-3-0x00007FFED83B0000-0x00007FFED83C0000-memory.dmp

Filesize
64KB

Download
memory/2088-7-0x00007FFED83B0000-0x00007FFED83C0000-memory.dmp

Filesize
64KB

Download
memory/2088-16-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-17-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-18-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-15-0x00007FFED5CA0000-0x00007FFED5CB0000-memory.dmp

Filesize
64KB

Download
memory/2088-11-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-19-0x00007FFED5CA0000-0x00007FFED5CB0000-memory.dmp

Filesize
64KB

Download
memory/2088-29-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-30-0x00007FFF183CD000-0x00007FFF183CE000-memory.dmp

Filesize
4KB

Download
memory/2088-34-0x00007FFF18330000-0x00007FFF18525000-memory.dmp

Filesize
2.0MB

Download
memory/2088-0-0x00007FFED83B0000-0x00007FFED83C0000-memory.dmp

Filesize
64KB

Download