3c33f4318d4b59cc14b73a9e02bcbe87b7418e7c899b0e608e44dd0ad1d813ab

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c33f4318d4b59cc14b73a9e02bcbe87b7418e7c899b0e608e44dd0ad1d813ab.xls
Size

70KB
MD5

7e8b007bc359a5abf53429d006de4d1f
SHA1

4336e2e8f36c75b0fcb4737835d38621ba12cc39
SHA256

3c33f4318d4b59cc14b73a9e02bcbe87b7418e7c899b0e608e44dd0ad1d813ab
SHA512

35f5d1e437867fd5fcedf1baf555a6e95fce992c231bd4646a199790a3fdaff2ff602ecf8b46dadb10e10ac2933edc3a0e502fd4615e8caa06b081c75926aa84
SSDEEP

1536:5+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgAYW/ESKQHS1yXJFadK0VB:kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgv

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://farschid.de/verkaufsberater_service/OZRw36a2y1CH2clUzY/

xlm40.dropper

http://77homolog.com.br/dev-jealves/GP55wbYNXnp6/

xlm40.dropper

http://geowf.ge/templates/pJRea3Iu3wG/

xlm40.dropper

http://h63402x4.beget.tech/bin/wl0ENiE3BhELXV6V/

xlm40.dropper

http://ecoarch.com.tw/cgi-bin/E/

xlm40.dropper

https://galaxy-catering.com.vn/galxy/Fg1vvhlYJ/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1532	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1532	EXCEL.EXE
1532	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1532	EXCEL.EXE
1532	EXCEL.EXE
1532	EXCEL.EXE
1532	EXCEL.EXE
1532	EXCEL.EXE
1532	EXCEL.EXE
1532	EXCEL.EXE
1532	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3c33f4318d4b59cc14b73a9e02bcbe87b7418e7c899b0e608e44dd0ad1d813ab.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
22b37b25070630468e57cab812acc6a8

SHA1
704eb62492b90afc40ebbc1018344913c5e862a0

SHA256
7693e0cc926d5192f03cdf947518ae6c06b06a9237ec141077dfc464dd472eb2

SHA512
2dcc41a688010f9bd304984244597a1321c0c5f0a5fe8a2ae6eb888d1b8ba1342b78e8485ad6da394e07dba8afd31a6cb33fb63cf7962c7e02e14b8be8c891bf

Download Submit
memory/1532-8-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-4-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

Filesize
64KB

Download
memory/1532-3-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

Filesize
64KB

Download
memory/1532-5-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-7-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

Filesize
64KB

Download
memory/1532-6-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-0-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

Filesize
64KB

Download
memory/1532-10-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-9-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-12-0x00007FF8848D0000-0x00007FF8848E0000-memory.dmp

Filesize
64KB

Download
memory/1532-1-0x00007FF8C69ED000-0x00007FF8C69EE000-memory.dmp

Filesize
4KB

Download
memory/1532-11-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-14-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-15-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-16-0x00007FF8848D0000-0x00007FF8848E0000-memory.dmp

Filesize
64KB

Download
memory/1532-17-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-13-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-20-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-19-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-18-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-30-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-31-0x00007FF8C69ED000-0x00007FF8C69EE000-memory.dmp

Filesize
4KB

Download
memory/1532-32-0x00007FF8C6950000-0x00007FF8C6B45000-memory.dmp

Filesize
2.0MB

Download
memory/1532-2-0x00007FF8869D0000-0x00007FF8869E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads