Overview
overview
10Static
static
3Nowy folder.rar
windows10-2004-x64
10Nowy folde...eta.db
windows10-2004-x64
3Nowy folde...s.json
windows10-2004-x64
3Nowy folde...ata.db
windows10-2004-x64
3Nowy folde...states
windows10-2004-x64
1Nowy folde...update
windows10-2004-x64
3Nowy folde...ab.csv
windows10-2004-x64
1Nowy folde...ab.txt
windows10-2004-x64
1Nowy folde...am.csv
windows10-2004-x64
1Nowy folde...am.txt
windows10-2004-x64
1Nowy folde...ui.csv
windows10-2004-x64
1Nowy folde...ui.txt
windows10-2004-x64
1Nowy folde...36.csv
windows10-2004-x64
1Nowy folde...36.txt
windows10-2004-x64
1Nowy folde...elease
windows10-2004-x64
3Nowy folde...ckages
windows10-2004-x64
3Nowy folde...elease
windows10-2004-x64
3Nowy folde...ckages
windows10-2004-x64
3Nowy folde...ckages
windows10-2004-x64
3Nowy folde...d.pkla
windows10-2004-x64
3Nowy folde...ERSION
windows10-2004-x64
1Nowy folde.../1/112
windows10-2004-x64
1Nowy folde.../1/113
windows10-2004-x64
1Nowy folde...1/1247
windows10-2004-x64
1Nowy folde...47_fsm
windows10-2004-x64
1Nowy folde...247_vm
windows10-2004-x64
1Nowy folde...1/1249
windows10-2004-x64
1Nowy folde...49_fsm
windows10-2004-x64
1Nowy folde...249_vm
windows10-2004-x64
1Nowy folde...1/1255
windows10-2004-x64
1Nowy folde...55_fsm
windows10-2004-x64
1Nowy folde...255_vm
windows10-2004-x64
1Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 19:54
Static task
static1
Behavioral task
behavioral1
Sample
Nowy folder.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Nowy folder/apt/emacsen-common/docker/containerd/daemon/io.containerd.metadata.v1.bolt/meta.db
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Nowy folder/apt/emacsen-common/docker/image/overlay2/repositories.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Nowy folder/apt/emacsen-common/docker/volumes/metadata.db
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Nowy folder/apt/extended_states
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Nowy folder/apt/ieee-data/.lastupdate
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Nowy folder/apt/ieee-data/iab.csv
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Nowy folder/apt/ieee-data/iab.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Nowy folder/apt/ieee-data/mam.csv
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
Nowy folder/apt/ieee-data/mam.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Nowy folder/apt/ieee-data/oui.csv
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
Nowy folder/apt/ieee-data/oui.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Nowy folder/apt/ieee-data/oui36.csv
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
Nowy folder/apt/ieee-data/oui36.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Nowy folder/apt/lists/deb.i2p2.no_dists_unstable_inrelease
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
Nowy folder/apt/lists/deb.i2p2.no_dists_unstable_main_binary-amd64_packages
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Nowy folder/apt/lists/http.kali.org_kali_dists_kali-rolling_inrelease
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
Nowy folder/apt/lists/http.kali.org_kali_dists_kali-rolling_contrib_binary-amd64_packages
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Nowy folder/apt/lists/http.kali.org_kali_dists_kali-rolling_non-free_binary-amd64_packages
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
Nowy folder/apt/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Nowy folder/apt/postgresql/13/main/PG_VERSION
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
Nowy folder/apt/postgresql/13/main/base/1/112
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Nowy folder/apt/postgresql/13/main/base/1/113
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
Nowy folder/apt/postgresql/13/main/base/1/1247
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Nowy folder/apt/postgresql/13/main/base/1/1247_fsm
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
Nowy folder/apt/postgresql/13/main/base/1/1247_vm
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Nowy folder/apt/postgresql/13/main/base/1/1249
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
Nowy folder/apt/postgresql/13/main/base/1/1249_fsm
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Nowy folder/apt/postgresql/13/main/base/1/1249_vm
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
Nowy folder/apt/postgresql/13/main/base/1/1255
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Nowy folder/apt/postgresql/13/main/base/1/1255_fsm
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
Nowy folder/apt/postgresql/13/main/base/1/1255_vm
Resource
win10v2004-20241007-en
General
-
Target
Nowy folder/apt/ieee-data/oui.csv
-
Size
28B
-
MD5
14fbb69d87e79c4677670febd1df04d4
-
SHA1
de6aa84cd002db707949ef690244ea781ebc2040
-
SHA256
134cf20dd9c248c4c8de4e926961a7ad884865510401371d2549cb74e71922cd
-
SHA512
0ffaf9dd719688883c3ada6ee67fef7d10656bdee79c669178e0bc344635d9600c0775f54ff646575db60beee79d65ef333771237921128fa61761496c3bef76
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1600 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Nowy folder\apt\ieee-data\oui.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize662B
MD5777f8cb3e23d1e6f1a253703cd6c69e4
SHA12e8da14eb8722f707fb08f5804e9cb939c53156d
SHA256175738a3d8b70403dcfe0dfddc4bd755919f497dbdb8d3fe24245ca7da129b8c
SHA51263cab3a7c445debb830e7f69b1d0cb217bfc374021f18d86e535ce03282f03fc80daf7827a18cf5d8421696b0b62550db932ff39aa592026f05bafb8399948f5