4322d95ab424af6c4e6e11bb06f675b7377a7a4604752b12ceeca4b0e0903c29

Analysis

max time kernel
133s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4322d95ab424af6c4e6e11bb06f675b7377a7a4604752b12ceeca4b0e0903c29.xls
Size

40KB
MD5

275b6626d42425801c2c672959425ccf
SHA1

97646cb15fd15cc74394c59eac38dcb408f593f5
SHA256

4322d95ab424af6c4e6e11bb06f675b7377a7a4604752b12ceeca4b0e0903c29
SHA512

0eac808c6fc9da489c86a45e661f7f819aca28a50f86c7ada6f3c7dbd14379ee5b6caed3ed386c827b2c6dcbf391e22d1e608b27a1d3d92c5944bfec6712a258
SSDEEP

768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgA9CBn9kC+xbPcfmBqGOtwvcVoclE:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dV

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://jimlowry.com/9tag/Mv2ZYY61NBOf8/

xlm40.dropper

http://stainedglassexpress.com/classes/veV/

xlm40.dropper

https://n-process.jp/base/HPH/

xlm40.dropper

http://www.4-hzim.org.zw/language/anCpC49vTB4/

xlm40.dropper

http://salledemode.com/tgroup.ge/6USqthYYyIPw4V/

xlm40.dropper

http://poiterdesign.eu/huur/nc/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4068	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4068	EXCEL.EXE
4068	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4068	EXCEL.EXE
4068	EXCEL.EXE
4068	EXCEL.EXE
4068	EXCEL.EXE
4068	EXCEL.EXE
4068	EXCEL.EXE
4068	EXCEL.EXE
4068	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4322d95ab424af6c4e6e11bb06f675b7377a7a4604752b12ceeca4b0e0903c29.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
cc14357e72815a39349e7380be6a1677

SHA1
45fd5916bb36ebbc0171383c1b96515f40021784

SHA256
5c2c4d6fed98792048777c5de1811d79044aa09d78d806d72abc0ec6bb8acc29

SHA512
238d0812b8b936d2fe4f03a65befee8bdb1916ca51b444f2a175bf429327f619d01cf68dbefce21f18faa8572ef504b2f97049fe12411c8e9953101ee9fcb1f5

Download Submit
memory/4068-10-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-8-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-2-0x00007FFB72090000-0x00007FFB720A0000-memory.dmp

Filesize
64KB

Download
memory/4068-4-0x00007FFB72090000-0x00007FFB720A0000-memory.dmp

Filesize
64KB

Download
memory/4068-5-0x00007FFB72090000-0x00007FFB720A0000-memory.dmp

Filesize
64KB

Download
memory/4068-9-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-0-0x00007FFB72090000-0x00007FFB720A0000-memory.dmp

Filesize
64KB

Download
memory/4068-11-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-12-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-13-0x00007FFB6FB60000-0x00007FFB6FB70000-memory.dmp

Filesize
64KB

Download
memory/4068-3-0x00007FFB72090000-0x00007FFB720A0000-memory.dmp

Filesize
64KB

Download
memory/4068-14-0x00007FFB6FB60000-0x00007FFB6FB70000-memory.dmp

Filesize
64KB

Download
memory/4068-19-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-16-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-18-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-20-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-15-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-17-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-7-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-6-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-30-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-31-0x00007FFBB20AD000-0x00007FFBB20AE000-memory.dmp

Filesize
4KB

Download
memory/4068-32-0x00007FFBB2010000-0x00007FFBB2205000-memory.dmp

Filesize
2.0MB

Download
memory/4068-1-0x00007FFBB20AD000-0x00007FFBB20AE000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads