e21f264e3915d5ac7038e1d8676702acf0faa7905294170144454468f79792ec

Analysis

max time kernel
133s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e21f264e3915d5ac7038e1d8676702acf0faa7905294170144454468f79792ec.xlsm
Size

20KB
MD5

96efd810af7504f8cf3df7ef36a1af21
SHA1

4a412ed74ef48285402a92e58f00b59a69c307d1
SHA256

e21f264e3915d5ac7038e1d8676702acf0faa7905294170144454468f79792ec
SHA512

a7b50206b64cdc8bdf32aaeb381d927d011f26fabeb7d2524fa3f7744f5f74e433b830948eef40e9db9976c633d467f63613067e025a020b270093c7ff1ddef9
SSDEEP

384:2QZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:2TINqTo4FL3CBn9kC+xbLHjj

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.bridgewien.at/admin/9Osvbo9caA4QYishnWka/

xlm40.dropper

http://bartboutens.nl/cgi-bin/aPqSkCZXI3ueRdI/

xlm40.dropper

http://aleph.org.ng/wp-includes/k8YwVWkrdmUM9/

xlm40.dropper

http://alkautsarlampung.sch.id/belajar/WQlNleMJKoulGBUvgC9/

xlm40.dropper

http://automyjniafordon.bydgoszcz.pl/123/mOWZgMaL/

xlm40.dropper

http://www.annuncisiciliani.it/app/3l1ZgVfwIEiIcGelh/

xlm40.dropper

http://autoat.mx/assets/VljikBuT029PkSBfrc/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3184	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3184	EXCEL.EXE
3184	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3184	EXCEL.EXE
3184	EXCEL.EXE
3184	EXCEL.EXE
3184	EXCEL.EXE
3184	EXCEL.EXE
3184	EXCEL.EXE
3184	EXCEL.EXE
3184	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e21f264e3915d5ac7038e1d8676702acf0faa7905294170144454468f79792ec.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
a5decabbb8f4c7d3cfe5eb5f411bbf07

SHA1
1372aff2c271ec8bf381e5e05839d4009c1966ad

SHA256
5b17070e84dc46c06f6af929da863f51994e83acf7f4f4aac02f45e4af2c142c

SHA512
84f916e4ada87da845710b935c05614ee27238e92de5fa7b1bcbed999076ca771398fcfca3224ab76b4d4f368236f66fa41258378648b6b3e94216987c2cc062

Download Submit
memory/3184-10-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-11-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-5-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-1-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

Filesize
64KB

Download
memory/3184-6-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

Filesize
64KB

Download
memory/3184-9-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-8-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-4-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-3-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

Filesize
64KB

Download
memory/3184-2-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

Filesize
64KB

Download
memory/3184-7-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

Filesize
64KB

Download
memory/3184-12-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-13-0x00007FFB01C50000-0x00007FFB01C60000-memory.dmp

Filesize
64KB

Download
memory/3184-14-0x00007FFB01C50000-0x00007FFB01C60000-memory.dmp

Filesize
64KB

Download
memory/3184-41-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-42-0x00007FFB43F2D000-0x00007FFB43F2E000-memory.dmp

Filesize
4KB

Download
memory/3184-43-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-45-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

Filesize
2.0MB

Download
memory/3184-0-0x00007FFB43F2D000-0x00007FFB43F2E000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads