7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f

General

Target

7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f.xlsm
Size

95KB
MD5

59c27c4aee530fd287c08a9914f6cb3e
SHA1

955dc2555fb07666981489885b912b722ec1bfea
SHA256

7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f
SHA512

5dac2db23e8bd49caf0da028ad95292648c5fa4162ca891d4f450b5ef6048213f3483bcda593ffc9a6f6fb9a6df9d5589ab0eb0546ef74beca3de8e9888100a3
SSDEEP

1536:8zCwXW5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVd1:8eWHDsVhonV69o2bchgGaWBcpAS1

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://thejobinassam.com/OLD/3r8/

xlm40.dropper

https://ishigamitoshio.com/cgi-bin/tiL/

xlm40.dropper

https://secsystembr.000webhostapp.com/wp-admin/ylfPOuPRX7skNx/

xlm40.dropper

https://fraudaware.org.uk/wp-admin/UPeayYdSM/

xlm40.dropper

https://angelstorehd.com/wp-includes/LBp6MO3/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2272	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2272	EXCEL.EXE
2272	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2272	EXCEL.EXE
2272	EXCEL.EXE
2272	EXCEL.EXE
2272	EXCEL.EXE
2272	EXCEL.EXE
2272	EXCEL.EXE
2272	EXCEL.EXE
2272	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7ffe084c0cdaccd1e790429719816617dfc349bac760c33234340c030e08c14f.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
6447917e1c34d87f44c4eb793355eccc

SHA1
9c477d1cc179418aefc8024af46282ddef10f397

SHA256
247d3656be4a8e83928c11f38f974ca74215d247526c1c7ff10194d867776f84

SHA512
94ecdd136eec4d0cc9a6d16c3dcc782db2c6112d978f341981e7d42bb44aa72539a654ae1dac0f992a5f4557d1d69c9490f0bfcf14a6c6f35e8ed31ec527d497

Download Submit
memory/2272-6-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-3-0x00007FFBD0C50000-0x00007FFBD0C60000-memory.dmp

Filesize
64KB

Download
memory/2272-5-0x00007FFBD0C50000-0x00007FFBD0C60000-memory.dmp

Filesize
64KB

Download
memory/2272-15-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-9-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-10-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-11-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-8-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-13-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-12-0x00007FFBCEA70000-0x00007FFBCEA80000-memory.dmp

Filesize
64KB

Download
memory/2272-7-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-1-0x00007FFC10C6D000-0x00007FFC10C6E000-memory.dmp

Filesize
4KB

Download
memory/2272-0-0x00007FFBD0C50000-0x00007FFBD0C60000-memory.dmp

Filesize
64KB

Download
memory/2272-4-0x00007FFBD0C50000-0x00007FFBD0C60000-memory.dmp

Filesize
64KB

Download
memory/2272-2-0x00007FFBD0C50000-0x00007FFBD0C60000-memory.dmp

Filesize
64KB

Download
memory/2272-19-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-21-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-20-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-17-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-18-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-16-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-49-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-50-0x00007FFC10C6D000-0x00007FFC10C6E000-memory.dmp

Filesize
4KB

Download
memory/2272-51-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-52-0x00007FFC10BD0000-0x00007FFC10DC5000-memory.dmp

Filesize
2.0MB

Download
memory/2272-14-0x00007FFBCEA70000-0x00007FFBCEA80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads