1d2c8baa74d775de16ce2150d4ec9ab5e72c45bf14d98d4561d5e270c1271576

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d2c8baa74d775de16ce2150d4ec9ab5e72c45bf14d98d4561d5e270c1271576.xls
Size

142KB
MD5

08900401e8e98c0314d9a33c8eb9b035
SHA1

c4dbf643e52e627cb511f452f82e8a365209b918
SHA256

1d2c8baa74d775de16ce2150d4ec9ab5e72c45bf14d98d4561d5e270c1271576
SHA512

e685041283bfab313ad94fc1fd40c4b8e311bc0d9efbaec7f4235d031aab342e2d2c5ec72755fcfbb6932d812b9b201aee36e30e89d4744ea61f7a4b8fd96160
SSDEEP

3072:kfKpbdrHYrMue8q7QPX+5xtekEdi8/dgA/c/mrWmngyYXnMJelsSKThsdskl4Wji:8KpbdrHYrMue8q7QPX+5xtFEdi8/dgAb

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.greenvalleyschool.com/rand_images/1R9sqGnZOFKmQi/

xlm40.dropper

https://www.travellers-autobarnrv.com/new/m9E2A5lQQ2noHkMP/

xlm40.dropper

https://www.campusconindigital.org/moodle311/oWZgMvUttcPDFNn/

xlm40.dropper

https://www.destinocuenca.com/libraries/oHuqdP31/

xlm40.dropper

https://www.defsalabs.com/videos/i1Dde2yzrONF5Nmhs28j/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2844	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2844	EXCEL.EXE
2844	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2844	EXCEL.EXE
2844	EXCEL.EXE
2844	EXCEL.EXE
2844	EXCEL.EXE
2844	EXCEL.EXE
2844	EXCEL.EXE
2844	EXCEL.EXE
2844	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1d2c8baa74d775de16ce2150d4ec9ab5e72c45bf14d98d4561d5e270c1271576.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
1cd28bbe263583315c0a5500a34dcc59

SHA1
d4ea9a8f784ff1c8cf663ff64cc8f3f763a2ee8c

SHA256
44c341a0c9b32b70a6fedde795c4717563cbf68303d3a461cf9140182f1b6760

SHA512
1401da69946f6f08625f8b94c277c944bfcb56fe9b088c0c5330aea7e2ce6a5f7644eb20e4afbcfa50d57550be6ff21187a58e5848bcd45870e4964e3d276364

Download Submit
memory/2844-12-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-7-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-2-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download
memory/2844-1-0x00007FF93656D000-0x00007FF93656E000-memory.dmp

Filesize
4KB

Download
memory/2844-0-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download
memory/2844-6-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-4-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download
memory/2844-10-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-9-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-8-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-3-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download
memory/2844-11-0x00007FF8F4420000-0x00007FF8F4430000-memory.dmp

Filesize
64KB

Download
memory/2844-20-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-15-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-16-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-18-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-13-0x00007FF8F4420000-0x00007FF8F4430000-memory.dmp

Filesize
64KB

Download
memory/2844-19-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-17-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-14-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-52-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-53-0x00007FF93656D000-0x00007FF93656E000-memory.dmp

Filesize
4KB

Download
memory/2844-54-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/2844-5-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads