Overview
overview
10Static
static
3IoC/00496083.xls
windows7-x64
3IoC/00496083.xls
windows10-2004-x64
1IoC/680589798891.xls
windows7-x64
3IoC/680589798891.xls
windows10-2004-x64
1Consignmen...df.exe
windows7-x64
10Consignmen...df.exe
windows10-2004-x64
10DHL SHIPME...PD.exe
windows7-x64
10DHL SHIPME...PD.exe
windows10-2004-x64
10EZ0496.exe
windows7-x64
10EZ0496.exe
windows10-2004-x64
10IoC/I05517...55.xls
windows7-x64
3IoC/I05517...55.xls
windows10-2004-x64
1IoC/I79540...11.xls
windows7-x64
3IoC/I79540...11.xls
windows10-2004-x64
1New Order ...22.exe
windows7-x64
10New Order ...22.exe
windows10-2004-x64
10$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Windows.Sy...ns.dll
windows10-2004-x64
3systeminfo.exe
windows10-2004-x64
3wecutil.exe
windows10-2004-x64
3New order ...22.exe
windows7-x64
10New order ...22.exe
windows10-2004-x64
10PO_#YBIC38...py.exe
windows7-x64
3PO_#YBIC38...py.exe
windows10-2004-x64
3Payment Ad...2).exe
windows7-x64
10Payment Ad...2).exe
windows10-2004-x64
10IoC/XSG8996380.xls
windows7-x64
3IoC/XSG8996380.xls
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:24
Static task
static1
Behavioral task
behavioral1
Sample
IoC/00496083.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
IoC/00496083.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
IoC/680589798891.xls
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
IoC/680589798891.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Consignment Document.pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Consignment Document.pdf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
DHL SHIPMENT NOTIFICATION 284748395PD.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
DHL SHIPMENT NOTIFICATION 284748395PD.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
EZ0496.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
EZ0496.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
IoC/I055170_06975755.xls
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
IoC/I055170_06975755.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
IoC/I795405_33242211.xls
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
IoC/I795405_33242211.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
New Order 00027748585 02222022.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
New Order 00027748585 02222022.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Windows.System.Diagnostics.TraceReporting.PlatformDiagnosticActions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
systeminfo.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
wecutil.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
New order 003848848575 02162022.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
New order 003848848575 02162022.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
PO_#YBIC3892900183902328_Evaluated Copy.exe
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
PO_#YBIC3892900183902328_Evaluated Copy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
Payment Advice for Outstanding Invoices (2).exe
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
Payment Advice for Outstanding Invoices (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
IoC/XSG8996380.xls
Resource
win7-20240729-en
Behavioral task
behavioral31
Sample
IoC/XSG8996380.xls
Resource
win10v2004-20241007-en
General
-
Target
IoC/I055170_06975755.xls
-
Size
94KB
-
MD5
44bbbdac3334b73c0f8773202d36cc60
-
SHA1
26fdaa1de7ea45d1f1b6b2ce5f86ee6e030f308f
-
SHA256
ef92e23f3ab74a0babcbd3bb96cedc7883bda95b3dab7b42c0d363ed4b18f535
-
SHA512
56ba1da3d1ade5dbfc41a151a75f65ac4ebbc645dd0ed4bce68b76ca00250a0f08167c71a9e391541a086aedc61498b1f7f0cee4ba4cc5bfe524905381860046
-
SSDEEP
1536:UsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0MokRElmW8bthBHOnMgQvUbwmq:UhlYkEIuPm3fNRZmbaoFhZhR0cixIHm5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2256 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\IoC\I055170_06975755.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD57c52d81cb1d43b12fd2df4b1fef0efc6
SHA1514243668197d913f3789e0020dbf75271579dbe
SHA256ecdba0b3ff658beebd94f387d9b5338a63953e594a49868b6bf69ae34e1545ad
SHA512804b81b574e8f68bf0a7425a0b554c49fde7fa712c61c6d8dddedecafb199bdb7d38b7a9ba645666a20d6f30f65e39100f25bd417560fe288a2f392d04bd5ccd