8340eba02f70a8fc0cb5bc54a522c1c296842849aba9e81011c0a1f30b39a22e

General

Target

8340eba02f70a8fc0cb5bc54a522c1c296842849aba9e81011c0a1f30b39a22e.xlsm
Size

20KB
MD5

c2e11f9ceb827f01d2f21287457386c8
SHA1

d8c644e46fefd2c177621c0d04f8c5f549ec9e2d
SHA256

8340eba02f70a8fc0cb5bc54a522c1c296842849aba9e81011c0a1f30b39a22e
SHA512

54e2502e73c468cbfe1f15674e188446b9c85ec76a16c2b69b1fd4d376f3c8d6a3c4d61733086894253744c97091bc32bed4f9b09082d2fef94e565ea80124c4
SSDEEP

384:yQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:yTINqTo4FL3CBn9kC+xbLHjj

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.bridgewien.at/admin/9Osvbo9caA4QYishnWka/

xlm40.dropper

http://bartboutens.nl/cgi-bin/aPqSkCZXI3ueRdI/

xlm40.dropper

http://aleph.org.ng/wp-includes/k8YwVWkrdmUM9/

xlm40.dropper

http://alkautsarlampung.sch.id/belajar/WQlNleMJKoulGBUvgC9/

xlm40.dropper

http://automyjniafordon.bydgoszcz.pl/123/mOWZgMaL/

xlm40.dropper

http://www.annuncisiciliani.it/app/3l1ZgVfwIEiIcGelh/

xlm40.dropper

http://autoat.mx/assets/VljikBuT029PkSBfrc/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1516	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1516	EXCEL.EXE
1516	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1516	EXCEL.EXE
1516	EXCEL.EXE
1516	EXCEL.EXE
1516	EXCEL.EXE
1516	EXCEL.EXE
1516	EXCEL.EXE
1516	EXCEL.EXE
1516	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8340eba02f70a8fc0cb5bc54a522c1c296842849aba9e81011c0a1f30b39a22e.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
45850916b5418804a9af931c8fd1ced0

SHA1
34c885ac9534730f6e42ad38524c1f291897e9e5

SHA256
ebf9e4599e94265ede5cecae242e5a6e031164b6a109e2d53dd3927e727412dd

SHA512
0520bec528ea280bd343a93b317e0711fef5f06fbc0ce3c2dd2cb172a0c078ad5de44a10ff4b6207ac0815af369bf2f9c6a06646b0d2d556f722d3b0bfaca315

Download Submit
memory/1516-8-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-6-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-7-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download
memory/1516-3-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download
memory/1516-14-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-5-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-10-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-16-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-11-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-13-0x00007FF8F4420000-0x00007FF8F4430000-memory.dmp

Filesize
64KB

Download
memory/1516-9-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-1-0x00007FF93656D000-0x00007FF93656E000-memory.dmp

Filesize
4KB

Download
memory/1516-4-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download
memory/1516-2-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download
memory/1516-12-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-15-0x00007FF8F4420000-0x00007FF8F4430000-memory.dmp

Filesize
64KB

Download
memory/1516-17-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-20-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-19-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-18-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-47-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-55-0x00007FF93656D000-0x00007FF93656E000-memory.dmp

Filesize
4KB

Download
memory/1516-56-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-61-0x00007FF9364D0000-0x00007FF9366C5000-memory.dmp

Filesize
2.0MB

Download
memory/1516-0-0x00007FF8F6550000-0x00007FF8F6560000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads