d6db12e1547c405e367eaf1b70853d07c19aebd4e472e6f4641186bfc5fbb128

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6db12e1547c405e367eaf1b70853d07c19aebd4e472e6f4641186bfc5fbb128.xls
Size

70KB
MD5

c2d073a3e579e5458604121276c05cbb
SHA1

6a16653d9ff79df7caeb23bd13aa1f31c5c35e3d
SHA256

d6db12e1547c405e367eaf1b70853d07c19aebd4e472e6f4641186bfc5fbb128
SHA512

dba0b36b4a6812e259a75052ca428a3e66c8977d548b00ac95416a2d4e6da5ffef37de64be7f1944f35b4caee4331b1f17ed448590ef0f90afeb5ee558056502
SSDEEP

1536:5+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgAYW/ESKQHS1yXJFadK01B:kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgP

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://farschid.de/verkaufsberater_service/OZRw36a2y1CH2clUzY/

xlm40.dropper

http://77homolog.com.br/dev-jealves/GP55wbYNXnp6/

xlm40.dropper

http://geowf.ge/templates/pJRea3Iu3wG/

xlm40.dropper

http://h63402x4.beget.tech/bin/wl0ENiE3BhELXV6V/

xlm40.dropper

http://ecoarch.com.tw/cgi-bin/E/

xlm40.dropper

https://galaxy-catering.com.vn/galxy/Fg1vvhlYJ/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
696	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
696	EXCEL.EXE
696	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
696	EXCEL.EXE
696	EXCEL.EXE
696	EXCEL.EXE
696	EXCEL.EXE
696	EXCEL.EXE
696	EXCEL.EXE
696	EXCEL.EXE
696	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d6db12e1547c405e367eaf1b70853d07c19aebd4e472e6f4641186bfc5fbb128.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
21bd9613ce1f59f4cb2a96f3e3af4726

SHA1
b14a47afebdd183e47f696068e77808b2e71547d

SHA256
e874e1ae374ba0a20601f8fd81daec43f814c64279ce08a9ea34ecf71cae0f23

SHA512
f92341955684835b97caff516cfa58f4e1d1cc75f35798d5abd4e3ddaa6f74cb9faaf4672c3ec460b43d3526c0dbe7458e9bf1cc1755c2268bd193db6b1604f7

Download Submit
memory/696-3-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/696-0-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/696-2-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/696-1-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/696-4-0x00007FFCE3A80000-0x00007FFCE3B1D000-memory.dmp

Filesize
628KB

Download
memory/696-5-0x00007FFCA6330000-0x00007FFCA6340000-memory.dmp

Filesize
64KB

Download
memory/696-6-0x00007FFCA40B0000-0x00007FFCA40C0000-memory.dmp

Filesize
64KB

Download
memory/696-7-0x00007FFCA40B0000-0x00007FFCA40C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads