b4fc5b365d6ccb4dc726a82c8b3f1c39ce16bf848c779706569c938d1a6855a8

Analysis

max time kernel
118s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2025, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls
Size

1.1MB
MD5

5debb3535cba6615526c64e44d0f5e2b
SHA1

abaa744d9504c7f23a237f8220ac6a441016d518
SHA256

5bac7a020f173d6c35f73d76cd3745a36564dbb3dd32f2d5fc5021c353e76a54
SHA512

4435f4deebc2f03c3a5659d1a870699d22fdb52525829373cf3bc0592db04da967e14f1e3f001b1cc0b974f8bddb96887480bcb7f14f3172caba1382866676c0
SSDEEP

12288:/bkdb1vJu/xtIIcnIE9A3HfOoV+4qF2KhaLZA6H/EHagqNC9:TkdbVJupvSmHfOoaF2KhaLZTx89

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3492	4688	certutil.exe	81

Executes dropped EXE 1 IoCs

pid	Process
4784	Z4U8K1S8.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3492	certutil.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Z4U8K1S8.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4688	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3492	4688	EXCEL.EXE	85
PID 4688 wrote to memory of 3492	4688	EXCEL.EXE	85
PID 4688 wrote to memory of 4784	4688	EXCEL.EXE	87
PID 4688 wrote to memory of 4784	4688	EXCEL.EXE	87
PID 4688 wrote to memory of 4784	4688	EXCEL.EXE	87

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\malware-sample-library-master\APT28 FancyBear\APT28DropperExcelDoc.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SYSTEM32\certutil.exe
  certutil -decode C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\T1U3H6N7.txt C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
  2⤵
  - Process spawned unexpected child process
  - Deobfuscate/Decode Files or Information
  PID:3492
- C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\T1U3H6N7.txt

Filesize
691KB

MD5
1b330a7f7cc348ce408c10b64c79a5e8

SHA1
e82ee9c54b78df69404f3fa75f8a3f703b72cb70

SHA256
4e77c794ccd2cb3a0139ce07f70e170b15bc1e618ac6959797cec889048b5005

SHA512
7a077b90802e020edbd545ed5726f1339052422026d9f3438592c35099ce1b168a8d2d2a6f3845ecb6422f54f388611f53c013ddaec74182ab98b7bd6b35682e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\Z4U8K1S8.exe

Filesize
518KB

MD5
ba78410702f0cc8453da1afbb2a8b670

SHA1
1083245ac66d4261f526d18d4eac79a7dbd72989

SHA256
9f9e74241d59eccfe7040bfdcbbceacb374eda397cc53a4197b59e4f6f380a91

SHA512
7433785795c68faa74b2d34b734cf4c4564940fbe21cb9ddd6c0251378455a9ded4595055059d42b73e8cdbfe59f16b4b4d4100fcca94a440bb9520f4572f74b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
2KB

MD5
135901c9d973f9b8d3fc7c8dabf1c952

SHA1
4f5b6637f8d39e35f32f635d203eb6d2fbed60a5

SHA256
d0d7276394eaf37cf619289979c33581eb64e82413b7644c555d382766cd8957

SHA512
f24cab31a9040b61b41ca539269011cd333beaec3fbe1aa21b6f96da33f07bfd29c84f413b714d28d804a670820b936c53b0524f1ee57637254a7de920671ba5

Download Submit
memory/4688-14-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-16-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-4-0x00007FFEAE4D0000-0x00007FFEAE4E0000-memory.dmp

Filesize
64KB

Download
memory/4688-6-0x00007FFEAE4D0000-0x00007FFEAE4E0000-memory.dmp

Filesize
64KB

Download
memory/4688-9-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-8-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-7-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-10-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-13-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-12-0x00007FFEAC180000-0x00007FFEAC190000-memory.dmp

Filesize
64KB

Download
memory/4688-11-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-0-0x00007FFEAE4D0000-0x00007FFEAE4E0000-memory.dmp

Filesize
64KB

Download
memory/4688-15-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-5-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-17-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-18-0x00007FFEAC180000-0x00007FFEAC190000-memory.dmp

Filesize
64KB

Download
memory/4688-29-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-31-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-30-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-40-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-38-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-37-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-1-0x00007FFEAE4D0000-0x00007FFEAE4E0000-memory.dmp

Filesize
64KB

Download
memory/4688-2-0x00007FFEAE4D0000-0x00007FFEAE4E0000-memory.dmp

Filesize
64KB

Download
memory/4688-45-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-46-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-47-0x00007FFEEE450000-0x00007FFEEE645000-memory.dmp

Filesize
2.0MB

Download
memory/4688-3-0x00007FFEEE4ED000-0x00007FFEEE4EE000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads