c1de15b5d043dd79dd267dd5f6d8f3ea9e15bc8a2ab63cb5fb4080cb4804c18e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

App_Dev_Details.xlsm
Size

70KB
MD5

246485b057592839c9ecd72a85fe9d39
SHA1

4cf0ae8960851a0d33801649ea5ce0eeb160a8e1
SHA256

6132d5fe4e8480e0fd80d842a230e53cb4e47f06bd5b3d5cf87ce0ac4ef464a4
SHA512

ae4a5e7259142df7ebcd6cdb6fca39c887e6e1e7bad4f585d8d1b587141ecf8493a55e9d3c3ff05a37547dce9ce9085cc3a3229baf3a18e8dd8062ad9e3a4198
SSDEEP

1536:eyCUk2qI4Deap+fjSCqP533pQp6mPw0MlKOhqVqr/3hGrOVLQ:RRGeCCShP536pdPOlFqVYvhGrO1Q

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 25 IoCs

Processes:

msiexec.exe

flow	pid	process
24	5088	msiexec.exe
29	5088	msiexec.exe
35	5088	msiexec.exe
36	5088	msiexec.exe
37	5088	msiexec.exe
46	5088	msiexec.exe
51	5088	msiexec.exe
52	5088	msiexec.exe
53	5088	msiexec.exe
54	5088	msiexec.exe
58	5088	msiexec.exe
63	5088	msiexec.exe
64	5088	msiexec.exe
65	5088	msiexec.exe
66	5088	msiexec.exe
70	5088	msiexec.exe
71	5088	msiexec.exe
72	5088	msiexec.exe
73	5088	msiexec.exe
74	5088	msiexec.exe
75	5088	msiexec.exe
76	5088	msiexec.exe
77	5088	msiexec.exe
78	5088	msiexec.exe
79	5088	msiexec.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1984 EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

EXCEL.EXEmsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1984	EXCEL.EXE
Token: SeIncreaseQuotaPrivilege	1984	EXCEL.EXE
Token: SeSecurityPrivilege	5088	msiexec.exe
Token: SeCreateTokenPrivilege	1984	EXCEL.EXE
Token: SeAssignPrimaryTokenPrivilege	1984	EXCEL.EXE
Token: SeLockMemoryPrivilege	1984	EXCEL.EXE
Token: SeIncreaseQuotaPrivilege	1984	EXCEL.EXE
Token: SeMachineAccountPrivilege	1984	EXCEL.EXE
Token: SeTcbPrivilege	1984	EXCEL.EXE
Token: SeSecurityPrivilege	1984	EXCEL.EXE
Token: SeTakeOwnershipPrivilege	1984	EXCEL.EXE
Token: SeLoadDriverPrivilege	1984	EXCEL.EXE
Token: SeSystemProfilePrivilege	1984	EXCEL.EXE
Token: SeSystemtimePrivilege	1984	EXCEL.EXE
Token: SeProfSingleProcessPrivilege	1984	EXCEL.EXE
Token: SeIncBasePriorityPrivilege	1984	EXCEL.EXE
Token: SeCreatePagefilePrivilege	1984	EXCEL.EXE
Token: SeCreatePermanentPrivilege	1984	EXCEL.EXE
Token: SeBackupPrivilege	1984	EXCEL.EXE
Token: SeRestorePrivilege	1984	EXCEL.EXE
Token: SeShutdownPrivilege	1984	EXCEL.EXE
Token: SeDebugPrivilege	1984	EXCEL.EXE
Token: SeAuditPrivilege	1984	EXCEL.EXE
Token: SeSystemEnvironmentPrivilege	1984	EXCEL.EXE
Token: SeChangeNotifyPrivilege	1984	EXCEL.EXE
Token: SeRemoteShutdownPrivilege	1984	EXCEL.EXE
Token: SeUndockPrivilege	1984	EXCEL.EXE
Token: SeSyncAgentPrivilege	1984	EXCEL.EXE
Token: SeEnableDelegationPrivilege	1984	EXCEL.EXE
Token: SeManageVolumePrivilege	1984	EXCEL.EXE
Token: SeImpersonatePrivilege	1984	EXCEL.EXE
Token: SeCreateGlobalPrivilege	1984	EXCEL.EXE
Token: SeShutdownPrivilege	1984	EXCEL.EXE
Token: SeIncreaseQuotaPrivilege	1984	EXCEL.EXE
Token: SeCreateTokenPrivilege	1984	EXCEL.EXE
Token: SeAssignPrimaryTokenPrivilege	1984	EXCEL.EXE
Token: SeLockMemoryPrivilege	1984	EXCEL.EXE
Token: SeIncreaseQuotaPrivilege	1984	EXCEL.EXE
Token: SeMachineAccountPrivilege	1984	EXCEL.EXE
Token: SeTcbPrivilege	1984	EXCEL.EXE
Token: SeSecurityPrivilege	1984	EXCEL.EXE
Token: SeTakeOwnershipPrivilege	1984	EXCEL.EXE
Token: SeLoadDriverPrivilege	1984	EXCEL.EXE
Token: SeSystemProfilePrivilege	1984	EXCEL.EXE
Token: SeSystemtimePrivilege	1984	EXCEL.EXE
Token: SeProfSingleProcessPrivilege	1984	EXCEL.EXE
Token: SeIncBasePriorityPrivilege	1984	EXCEL.EXE
Token: SeCreatePagefilePrivilege	1984	EXCEL.EXE
Token: SeCreatePermanentPrivilege	1984	EXCEL.EXE
Token: SeBackupPrivilege	1984	EXCEL.EXE
Token: SeRestorePrivilege	1984	EXCEL.EXE
Token: SeShutdownPrivilege	1984	EXCEL.EXE
Token: SeDebugPrivilege	1984	EXCEL.EXE
Token: SeAuditPrivilege	1984	EXCEL.EXE
Token: SeSystemEnvironmentPrivilege	1984	EXCEL.EXE
Token: SeChangeNotifyPrivilege	1984	EXCEL.EXE
Token: SeRemoteShutdownPrivilege	1984	EXCEL.EXE
Token: SeUndockPrivilege	1984	EXCEL.EXE
Token: SeSyncAgentPrivilege	1984	EXCEL.EXE
Token: SeEnableDelegationPrivilege	1984	EXCEL.EXE
Token: SeManageVolumePrivilege	1984	EXCEL.EXE
Token: SeImpersonatePrivilege	1984	EXCEL.EXE
Token: SeCreateGlobalPrivilege	1984	EXCEL.EXE
Token: SeShutdownPrivilege	1984	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE
1984	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\App_Dev_Details.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-2-0x00007FF8F39F0000-0x00007FF8F3A00000-memory.dmp

Filesize
64KB

Download
memory/1984-3-0x00007FF8F39F0000-0x00007FF8F3A00000-memory.dmp

Filesize
64KB

Download
memory/1984-1-0x00007FF933A0D000-0x00007FF933A0E000-memory.dmp

Filesize
4KB

Download
memory/1984-0-0x00007FF8F39F0000-0x00007FF8F3A00000-memory.dmp

Filesize
64KB

Download
memory/1984-6-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-5-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-4-0x00007FF8F39F0000-0x00007FF8F3A00000-memory.dmp

Filesize
64KB

Download
memory/1984-8-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-7-0x00007FF8F39F0000-0x00007FF8F3A00000-memory.dmp

Filesize
64KB

Download
memory/1984-9-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-11-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-12-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-13-0x00007FF8F15A0000-0x00007FF8F15B0000-memory.dmp

Filesize
64KB

Download
memory/1984-10-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-14-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-18-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-17-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-19-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-16-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-21-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-20-0x00007FF8F15A0000-0x00007FF8F15B0000-memory.dmp

Filesize
64KB

Download
memory/1984-15-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-32-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-31-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-39-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-40-0x00007FF933A0D000-0x00007FF933A0E000-memory.dmp

Filesize
4KB

Download
memory/1984-41-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-42-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download
memory/1984-43-0x00007FF933970000-0x00007FF933B65000-memory.dmp

Filesize
2.0MB

Download