ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575

Analysis

max time kernel
133s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575.xlsm
Size

50KB
MD5

651d494738af84de6122691367fb7f7d
SHA1

3b9fc5186d8a9b233449df3d4d044364e906800a
SHA256

ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575
SHA512

eecef52daf357af9800ca2956a2b642db987527bf2d7eb9e4cac553c23b7e2ec8bcf5fad269046497ef04a2cd0e69dd821b678d9c3231334c3e51229cd835b45
SSDEEP

768:Tx9D9onsXslSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0P4F:TXD9okncDSmSIBlGeuSEcm2h0BPu

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://centrobilinguelospinos.com/wp-admin/VrgzWT/

xlm40.dropper

http://boardingschoolsoftware.com/backup/CtMR5Yi/

xlm40.dropper

http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/

xlm40.dropper

http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/

xlm40.dropper

https://descontador.com.br/css/q5nrG6ua/

xlm40.dropper

http://letea.eu/wp-content/3GgF4miFZTq9/

xlm40.dropper

http://quoctoan.c1.biz/wp-admin/j8Zu/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4480	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4480	EXCEL.EXE
4480	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4480	EXCEL.EXE
4480	EXCEL.EXE
4480	EXCEL.EXE
4480	EXCEL.EXE
4480	EXCEL.EXE
4480	EXCEL.EXE
4480	EXCEL.EXE
4480	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
c8983d0cd019af4beb37236826477ca2

SHA1
0eb4fa954f05bd7d4d9da46a69c6bd8d1835f8d6

SHA256
9af070c9497153a58e3c91926d545f911631b70747da21b172d128b0e26d45bd

SHA512
2678461ceccb92fcee2a25a647f8d7a02cdd0c79754f4e408b732cf8c18cdd602828ea2204654244fead95fa703acddf4e8b17069fa12a1ef98857dc22431d76

Download Submit
memory/4480-10-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-2-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

Filesize
64KB

Download
memory/4480-1-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

Filesize
64KB

Download
memory/4480-4-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

Filesize
64KB

Download
memory/4480-8-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-7-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-11-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-13-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-0-0x00007FFF1924D000-0x00007FFF1924E000-memory.dmp

Filesize
4KB

Download
memory/4480-12-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-15-0x00007FFED6A80000-0x00007FFED6A90000-memory.dmp

Filesize
64KB

Download
memory/4480-9-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-14-0x00007FFED6A80000-0x00007FFED6A90000-memory.dmp

Filesize
64KB

Download
memory/4480-16-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-6-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-5-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

Filesize
64KB

Download
memory/4480-26-0x00007FFF1924D000-0x00007FFF1924E000-memory.dmp

Filesize
4KB

Download
memory/4480-27-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-28-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

Filesize
2.0MB

Download
memory/4480-3-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads