48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b

Analysis

max time kernel
133s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b.xll
Size

42KB
MD5

621e294da3d079e3d5b57836e487812a
SHA1

4652280ed016154900b0846f777278c0bab17453
SHA256

48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b
SHA512

99264960418691f2d3f374c8149fb1b7a0276fcd179a2bd9d945ddf92e88c68df6542d8ddc7ebb1c6d70f1c7fd9687f1ee102e71e69211ba20d0eb3928a6e30e
SSDEEP

768:Ybb75EEnHDxr5KI3dOm+I4oU5xWw4HPf84q+lniu82me6Y+V2kw53iGf2mmqSZO8:mtEEjxrMS+J52HX8Jme5rGXMygAm

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2816 EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

EXCEL.EXE

pid	process
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE
2816	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\48792bb5e220daf2e04bf812584f47e73e7bd2c82cd20c2f8c3aa924113f368b.xll"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
3KB

MD5
0b4d375b91b3ca8ba591800d54c1d215

SHA1
10d7a60fbab4a8589732dd15eab94a04663328a2

SHA256
2e783447318b179985d55bf043ccf0c8c1134b8260a999c5dfcce86b461bf404

SHA512
68d0f23e7f8a2a75b3c15595167db15d25f94058addd1260767ac25b0f6d95167957c1334eb4c64e9df8843ff25bebdbce27f4fe9027392f9a96a4775f626e46

Download Submit
memory/2816-12-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-1-0x00007FFED1D8D000-0x00007FFED1D8E000-memory.dmp

Filesize
4KB

Download
memory/2816-13-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-4-0x00007FFE91D70000-0x00007FFE91D80000-memory.dmp

Filesize
64KB

Download
memory/2816-6-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-5-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-10-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-9-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-8-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-14-0x00007FFE8F440000-0x00007FFE8F450000-memory.dmp

Filesize
64KB

Download
memory/2816-3-0x00007FFE91D70000-0x00007FFE91D80000-memory.dmp

Filesize
64KB

Download
memory/2816-2-0x00007FFE91D70000-0x00007FFE91D80000-memory.dmp

Filesize
64KB

Download
memory/2816-11-0x00007FFE8F440000-0x00007FFE8F450000-memory.dmp

Filesize
64KB

Download
memory/2816-15-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-17-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-18-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-16-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-7-0x00007FFE91D70000-0x00007FFE91D80000-memory.dmp

Filesize
64KB

Download
memory/2816-28-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-29-0x00007FFED1D8D000-0x00007FFED1D8E000-memory.dmp

Filesize
4KB

Download
memory/2816-30-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-34-0x00007FFED1CF0000-0x00007FFED1EE5000-memory.dmp

Filesize
2.0MB

Download
memory/2816-0-0x00007FFE91D70000-0x00007FFE91D80000-memory.dmp

Filesize
64KB

Download