980ad01e9aeb1f53aa0c21fe2ee5689faa76bf1568fae3c3dc71f902708ee701

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

980ad01e9aeb1f53aa0c21fe2ee5689faa76bf1568fae3c3dc71f902708ee701 (1).xls
Size

3.3MB
MD5

348a43e48d22c209bc789e0dc1edef3a
SHA1

d3307e2f24c6a7305fab66a3097d8e0c8266c285
SHA256

980ad01e9aeb1f53aa0c21fe2ee5689faa76bf1568fae3c3dc71f902708ee701
SHA512

a7fe30108af0a2ff0026b0c4cbeb2081c25a51de41b9018f8d84a1b308e60fa5e5c037709518c05c1918fc38631811addceec852eae6d6f60334490acf77cbdc
SSDEEP

24576:EoveMC5Lpbrojk5zc3dTVWhX/T8GhE794D1Ljoq0OrYO096Q96wHiErt0FgSWZrk:HjTVW5FCdyJ6

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
4624	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid	Process
4624	EXCEL.EXE
4624	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	Process
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE
4624	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description	pid	Process	procid_target
PID 4624 wrote to memory of 712	4624	EXCEL.EXE	86
PID 4624 wrote to memory of 712	4624	EXCEL.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\980ad01e9aeb1f53aa0c21fe2ee5689faa76bf1568fae3c3dc71f902708ee701 (1).xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
aa6844076996da37f893b2fedd950471

SHA1
42faaa3dc3fdba0cb970f8427d0a8b4ba8486685

SHA256
199a9a005a6bf3cda9efaa028349320853ed416f149e6a91b43e9a3d9f64bf55

SHA512
f71642f8c5bcf0b684eb9237d9b7b51d8f59f1f972a47201241a4e3cce795fb32c968af471d8a7b3f9a64951bbdf2ec2f9c52e0f6af407cd75bd46ed00f0c417

Download Submit
memory/4624-1-0x00007FFD1B28D000-0x00007FFD1B28E000-memory.dmp

Filesize
4KB

Download
memory/4624-107-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-5-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/4624-28-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-11-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-12-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-10-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-9-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-13-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-14-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-17-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-16-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-18-0x00007FFCD9210000-0x00007FFCD9220000-memory.dmp

Filesize
64KB

Download
memory/4624-15-0x00007FFCD9210000-0x00007FFCD9220000-memory.dmp

Filesize
64KB

Download
memory/4624-8-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-6-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-2-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/4624-0-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/4624-7-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-4-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download
memory/4624-93-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-90-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-84-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-83-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-82-0x00007FFD1B28D000-0x00007FFD1B28E000-memory.dmp

Filesize
4KB

Download
memory/4624-96-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-97-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-98-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-95-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-100-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-102-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-101-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-99-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-94-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-103-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-48-0x00007FFD1B1F0000-0x00007FFD1B3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4624-3-0x00007FFCDB270000-0x00007FFCDB280000-memory.dmp

Filesize
64KB

Download