Overview
overview
10Static
static
38200755cbe...33.exe
windows7-x64
88200755cbe...33.exe
windows10-2004-x64
829c7e87350...5b.exe
windows7-x64
129c7e87350...5b.exe
windows10-2004-x64
349cccd30a5...90.exe
windows7-x64
149cccd30a5...90.exe
windows10-2004-x64
3b17911ddea...82.exe
windows7-x64
1b17911ddea...82.exe
windows10-2004-x64
302ca4397da...51.exe
windows7-x64
302ca4397da...51.exe
windows10-2004-x64
3022aeb126d...74.exe
windows7-x64
9022aeb126d...74.exe
windows10-2004-x64
9smb-7teux2sm.exe
windows7-x64
9smb-7teux2sm.exe
windows10-2004-x64
9smb-onil0o36.exe
windows7-x64
9smb-onil0o36.exe
windows10-2004-x64
9malware-sa...ab.exe
windows7-x64
10malware-sa...ab.exe
windows10-2004-x64
10malware-sa...1).exe
windows7-x64
6malware-sa...1).exe
windows10-2004-x64
malware-sa...n.xlsx
windows7-x64
3malware-sa...n.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2025 11:14
Static task
static1
Behavioral task
behavioral1
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
29c7e87350cb03428fc108b03856095b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
49cccd30a564410d1f9bbce89fa15890.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
b17911ddeab973db51362721c940d882.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
022aeb126d2d80e683f7f2a3ee920874.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
smb-7teux2sm.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
smb-7teux2sm.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
smb-onil0o36.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
smb-onil0o36.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
malware-samples-master/Ransomware/Grandcrab/grandcab.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
malware-samples-master/Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
Resource
win10v2004-20241007-en
General
-
Target
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
-
Size
14KB
-
MD5
248cd700a82449f4b0d107e6a934ae2b
-
SHA1
d1763d827d614ddd6f3ca046ec6d1cf880f4dc25
-
SHA256
6ff88255226a7f0de338e8383904a6fd8af5eb630c28ae6846b107de41fa22ef
-
SHA512
c5755cc015b3e6aa30ce1c87c05a7712fc7939f57d7d470025a50c8d280ad53d97701f34b85b8f9300652989720915ccac28a22925e73ea48455116f37c31746
-
SSDEEP
384:YlbZERmunyjfOOTXC6ACMYMx3pF5dBwDVfJZKTvazDpzQ:OdunyXXC6jzqTKVxZ7zDC
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 440 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\malware-samples-master\mitre-attack\Emotet+Trickbot_comparison.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize4KB
MD53ded632217b4d5481f006005f832b7a8
SHA1c4ab6b9b52f7c91c0b426cd7cac1ffcb968a6eef
SHA256206a54e66ad6f6840bd6d77d6e8e4cf0a0dd96849d9ba70dc3d096531aabaa20
SHA5125dee038675ea5384fc9e29e4d7bbaae0a71f351497401d20c9c69e55d865c39b86e2f01c3a3d5b0ba689a9898eda8641d353f4910f819d99f2e747f5f6bc2a80