Overview
overview
10Static
static
3Nowy folder.rar
windows10-2004-x64
10Nowy folde...eta.db
windows10-2004-x64
3Nowy folde...s.json
windows10-2004-x64
3Nowy folde...ata.db
windows10-2004-x64
3Nowy folde...states
windows10-2004-x64
1Nowy folde...update
windows10-2004-x64
3Nowy folde...ab.csv
windows10-2004-x64
1Nowy folde...ab.txt
windows10-2004-x64
1Nowy folde...am.csv
windows10-2004-x64
1Nowy folde...am.txt
windows10-2004-x64
1Nowy folde...ui.csv
windows10-2004-x64
1Nowy folde...ui.txt
windows10-2004-x64
1Nowy folde...36.csv
windows10-2004-x64
1Nowy folde...36.txt
windows10-2004-x64
1Nowy folde...elease
windows10-2004-x64
3Nowy folde...ckages
windows10-2004-x64
3Nowy folde...elease
windows10-2004-x64
3Nowy folde...ckages
windows10-2004-x64
3Nowy folde...ckages
windows10-2004-x64
3Nowy folde...d.pkla
windows10-2004-x64
3Nowy folde...ERSION
windows10-2004-x64
1Nowy folde.../1/112
windows10-2004-x64
1Nowy folde.../1/113
windows10-2004-x64
1Nowy folde...1/1247
windows10-2004-x64
1Nowy folde...47_fsm
windows10-2004-x64
1Nowy folde...247_vm
windows10-2004-x64
1Nowy folde...1/1249
windows10-2004-x64
1Nowy folde...49_fsm
windows10-2004-x64
1Nowy folde...249_vm
windows10-2004-x64
1Nowy folde...1/1255
windows10-2004-x64
1Nowy folde...55_fsm
windows10-2004-x64
1Nowy folde...255_vm
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 19:54
Static task
static1
Behavioral task
behavioral1
Sample
Nowy folder.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Nowy folder/apt/emacsen-common/docker/containerd/daemon/io.containerd.metadata.v1.bolt/meta.db
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Nowy folder/apt/emacsen-common/docker/image/overlay2/repositories.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Nowy folder/apt/emacsen-common/docker/volumes/metadata.db
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Nowy folder/apt/extended_states
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Nowy folder/apt/ieee-data/.lastupdate
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Nowy folder/apt/ieee-data/iab.csv
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Nowy folder/apt/ieee-data/iab.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Nowy folder/apt/ieee-data/mam.csv
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
Nowy folder/apt/ieee-data/mam.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Nowy folder/apt/ieee-data/oui.csv
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
Nowy folder/apt/ieee-data/oui.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Nowy folder/apt/ieee-data/oui36.csv
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
Nowy folder/apt/ieee-data/oui36.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Nowy folder/apt/lists/deb.i2p2.no_dists_unstable_inrelease
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
Nowy folder/apt/lists/deb.i2p2.no_dists_unstable_main_binary-amd64_packages
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Nowy folder/apt/lists/http.kali.org_kali_dists_kali-rolling_inrelease
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
Nowy folder/apt/lists/http.kali.org_kali_dists_kali-rolling_contrib_binary-amd64_packages
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Nowy folder/apt/lists/http.kali.org_kali_dists_kali-rolling_non-free_binary-amd64_packages
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
Nowy folder/apt/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Nowy folder/apt/postgresql/13/main/PG_VERSION
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
Nowy folder/apt/postgresql/13/main/base/1/112
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Nowy folder/apt/postgresql/13/main/base/1/113
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
Nowy folder/apt/postgresql/13/main/base/1/1247
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Nowy folder/apt/postgresql/13/main/base/1/1247_fsm
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
Nowy folder/apt/postgresql/13/main/base/1/1247_vm
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Nowy folder/apt/postgresql/13/main/base/1/1249
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
Nowy folder/apt/postgresql/13/main/base/1/1249_fsm
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Nowy folder/apt/postgresql/13/main/base/1/1249_vm
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
Nowy folder/apt/postgresql/13/main/base/1/1255
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Nowy folder/apt/postgresql/13/main/base/1/1255_fsm
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
Nowy folder/apt/postgresql/13/main/base/1/1255_vm
Resource
win10v2004-20241007-en
General
-
Target
Nowy folder/apt/ieee-data/oui36.csv
-
Size
30B
-
MD5
387c27ab603468e6e695a7d67a0315a5
-
SHA1
cb65a3f1629b2d75042aaba9c65da9174a9905a2
-
SHA256
4874244f60fa54310865244eabbfdcdeef67e4ea3a173bbaa4d185d5b4b664bc
-
SHA512
07c4673c6942023dfdc9ed10cbfdf9d51e05d51c8aa3a8921a8b7bd39e7af093b8ee4583a11ee30bd8a848ea5705d60dfecf27f96060dfe935a093ed291307d8
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3120 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE 3120 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Nowy folder\apt\ieee-data\oui36.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize2KB
MD5717d46661018139eb7884568f618ff6e
SHA12cfd73ac89a2d1be40156df810261ea031ab0852
SHA2568ad1e0bc51d7cfe60652c96ffd01ec02ce3da432865e503704242b8017f2d315
SHA512e03611c18eba7d747a0d9f31514973538f5fbade3ce913ad369af4d98e3aa5071bdb55d02bf75065fcc98280bf81adeeda38a6cc9dc1343ffe51aed74abbae53