Overview
overview
10Static
static
3IoC/00496083.xls
windows7-x64
3IoC/00496083.xls
windows10-2004-x64
1IoC/680589798891.xls
windows7-x64
3IoC/680589798891.xls
windows10-2004-x64
1Consignmen...df.exe
windows7-x64
10Consignmen...df.exe
windows10-2004-x64
10DHL SHIPME...PD.exe
windows7-x64
10DHL SHIPME...PD.exe
windows10-2004-x64
10EZ0496.exe
windows7-x64
10EZ0496.exe
windows10-2004-x64
10IoC/I05517...55.xls
windows7-x64
3IoC/I05517...55.xls
windows10-2004-x64
1IoC/I79540...11.xls
windows7-x64
3IoC/I79540...11.xls
windows10-2004-x64
1New Order ...22.exe
windows7-x64
10New Order ...22.exe
windows10-2004-x64
10$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Windows.Sy...ns.dll
windows10-2004-x64
3systeminfo.exe
windows10-2004-x64
3wecutil.exe
windows10-2004-x64
3New order ...22.exe
windows7-x64
10New order ...22.exe
windows10-2004-x64
10PO_#YBIC38...py.exe
windows7-x64
3PO_#YBIC38...py.exe
windows10-2004-x64
3Payment Ad...2).exe
windows7-x64
10Payment Ad...2).exe
windows10-2004-x64
10IoC/XSG8996380.xls
windows7-x64
3IoC/XSG8996380.xls
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 21:57
Static task
static1
Behavioral task
behavioral1
Sample
IoC/00496083.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
IoC/00496083.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
IoC/680589798891.xls
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
IoC/680589798891.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Consignment Document.pdf.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Consignment Document.pdf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
DHL SHIPMENT NOTIFICATION 284748395PD.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
DHL SHIPMENT NOTIFICATION 284748395PD.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
EZ0496.exe
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
EZ0496.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
IoC/I055170_06975755.xls
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
IoC/I055170_06975755.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
IoC/I795405_33242211.xls
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
IoC/I795405_33242211.xls
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
New Order 00027748585 02222022.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
New Order 00027748585 02222022.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Windows.System.Diagnostics.TraceReporting.PlatformDiagnosticActions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
systeminfo.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
wecutil.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
New order 003848848575 02162022.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
New order 003848848575 02162022.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
PO_#YBIC3892900183902328_Evaluated Copy.exe
Resource
win7-20241023-en
Behavioral task
behavioral27
Sample
PO_#YBIC3892900183902328_Evaluated Copy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
Payment Advice for Outstanding Invoices (2).exe
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
Payment Advice for Outstanding Invoices (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
IoC/XSG8996380.xls
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
IoC/XSG8996380.xls
Resource
win10v2004-20241007-en
General
-
Target
IoC/I055170_06975755.xls
-
Size
94KB
-
MD5
44bbbdac3334b73c0f8773202d36cc60
-
SHA1
26fdaa1de7ea45d1f1b6b2ce5f86ee6e030f308f
-
SHA256
ef92e23f3ab74a0babcbd3bb96cedc7883bda95b3dab7b42c0d363ed4b18f535
-
SHA512
56ba1da3d1ade5dbfc41a151a75f65ac4ebbc645dd0ed4bce68b76ca00250a0f08167c71a9e391541a086aedc61498b1f7f0cee4ba4cc5bfe524905381860046
-
SSDEEP
1536:UsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0MokRElmW8bthBHOnMgQvUbwmq:UhlYkEIuPm3fNRZmbaoFhZhR0cixIHm5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2840 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE 2840 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\IoC\I055170_06975755.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD55c182267e03d733185f0438bc37fd333
SHA103c9d97a8bc07ee4510774aae7f238455398bf1b
SHA2562a897285294b575713fd6cbf2636ecb1eea2f33395aa4af0fd166d7f45f69d3f
SHA5124605ee00f70cc7030550eba7eb05694680d935881d3b6f8bb169828158a4f3f08c11f47e419c8f2fd38d0f6dcfefc53ae2b7dd7f53012b8b3a6984e5c4db1e8d