2449ba5988d051b6538df80bca953cc6fa729dd78cc4d9a1a02d598cf12aef14

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2449ba5988d051b6538df80bca953cc6fa729dd78cc4d9a1a02d598cf12aef14.xls
Size

101KB
MD5

a8fa3eabc850aa778a2512f50d080099
SHA1

4997ace17e46c3e0c25438860e39c0cdd728dc75
SHA256

2449ba5988d051b6538df80bca953cc6fa729dd78cc4d9a1a02d598cf12aef14
SHA512

c69673f60f1925062f792f074ab4fe2bcd3d3e4779ec1120cb0d1e3a32bca24ea9bb70129e33bf47a26e9b60ba2845e2a1c657efef3ae5068be3849c2a5cca59
SSDEEP

3072:RKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+/bOZzbqkn6RND9fxuss8Om:RKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+f

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://decorusfinancial.com/wp-content/7dODakeZZ83fJi/

xlm40.dropper

https://e-kinerja.ntbprov.go.id/aset/sAeaEvaSxGhvnsuFE/

xlm40.dropper

http://facts-jo.com/init/jLQY2FpesnIGi0qHqz/

xlm40.dropper

http://fashionbyprincessmelodicaah.com/4185PINT/jwh2cwjFHLZL/

xlm40.dropper

http://easiercommunications.com/wp-content/yqNxi8IKbRIt7akB/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4856	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4856	EXCEL.EXE
4856	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4856	EXCEL.EXE
4856	EXCEL.EXE
4856	EXCEL.EXE
4856	EXCEL.EXE
4856	EXCEL.EXE
4856	EXCEL.EXE
4856	EXCEL.EXE
4856	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2449ba5988d051b6538df80bca953cc6fa729dd78cc4d9a1a02d598cf12aef14.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
836e649c659b267fce8ad8ea67d3c0d9

SHA1
1ca4e16523c668bc7b278bc75e2b87f85108a9b2

SHA256
00e0af9aa8583755df271f7f6d86a046b4b11326aad58d6587c53b7388c1d183

SHA512
8200b890e35563a70368722832e53c72d2fc2a2720915acf8ca362535e122e8699c144c4383b02e6f3f3a54ceec268324691b4af0d9b1c4826da2f16b3abba13

Download Submit
memory/4856-18-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-1-0x00007FFA5480D000-0x00007FFA5480E000-memory.dmp

Filesize
4KB

Download
memory/4856-17-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-10-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-9-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-8-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-6-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-5-0x00007FFA147F0000-0x00007FFA14800000-memory.dmp

Filesize
64KB

Download
memory/4856-3-0x00007FFA147F0000-0x00007FFA14800000-memory.dmp

Filesize
64KB

Download
memory/4856-16-0x00007FFA126E0000-0x00007FFA126F0000-memory.dmp

Filesize
64KB

Download
memory/4856-7-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-4-0x00007FFA147F0000-0x00007FFA14800000-memory.dmp

Filesize
64KB

Download
memory/4856-2-0x00007FFA147F0000-0x00007FFA14800000-memory.dmp

Filesize
64KB

Download
memory/4856-15-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-14-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-13-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-12-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-11-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-19-0x00007FFA126E0000-0x00007FFA126F0000-memory.dmp

Filesize
64KB

Download
memory/4856-31-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-32-0x00007FFA5480D000-0x00007FFA5480E000-memory.dmp

Filesize
4KB

Download
memory/4856-33-0x00007FFA54770000-0x00007FFA54965000-memory.dmp

Filesize
2.0MB

Download
memory/4856-0-0x00007FFA147F0000-0x00007FFA14800000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads