Overview
overview
10Static
static
35af0f5b0ba...de.exe
windows7-x64
105af0f5b0ba...de.exe
windows10-2004-x64
10MihalyLeve...g.docx
windows7-x64
3MihalyLeve...g.docx
windows10-2004-x64
1Mihály Le...17.pdf
windows7-x64
3Mihály Le...17.pdf
windows10-2004-x64
3Mérések ...2.xlsx
windows7-x64
3Mérések ...2.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2025, 21:11
Static task
static1
Behavioral task
behavioral1
Sample
5af0f5b0bada5b7aaa681eddebc47734267af06eb39610590a625315f449d4de.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5af0f5b0bada5b7aaa681eddebc47734267af06eb39610590a625315f449d4de.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
MihalyLevente_Vezetotrening.docx
Resource
win7-20250207-en
Behavioral task
behavioral4
Sample
MihalyLevente_Vezetotrening.docx
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
Mihály Levente_Tartalmi kivonat_2017.pdf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Mihály Levente_Tartalmi kivonat_2017.pdf
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
Mérések Co2 lézeres kezelésre_v2.xlsx
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Mérések Co2 lézeres kezelésre_v2.xlsx
Resource
win10v2004-20250314-en
General
-
Target
Mérések Co2 lézeres kezelésre_v2.xlsx
-
Size
47KB
-
MD5
1f6317291ab6d7789947860ed92885d1
-
SHA1
bf7eac4d1e74aefa63f8104d541dd98f3e7a9e47
-
SHA256
a5fe7ab849f57ddbc0c03c783abe786caa21b174e6744bb87330217f0866b132
-
SHA512
46588d572787dbe0e4075764462cce4c16ccea54db6f088b292cc5256dcf76fd6e9112f584ad87b51f07d24f0e2d53ef24a7c335baf9d6c81b392fefc10559c7
-
SSDEEP
768:TPazaRvYNB1GrrfMQJ48HIz2FAIZ4kXS2PDjVr/N51M9OofTLHVqFxa0eSiT:WzadYT1MoRCIzEewl/NTMoWzVqFcbT
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3996 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE 3996 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Mérések Co2 lézeres kezelésre_v2.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5bef3836783d3f8cccec0b99dc66da112
SHA18cb6241255fca5d85e6b77ef0f7dea6496cfcd15
SHA2562cbb9d53a8100fa974d4051dbd2ea2be4cd449cd984d62429e9044c5a3ee9948
SHA51225b684b8001a3af0e4930dca45e743938cd6200703a5a6ae4706fcca9fe5169c0a7f35ae85b0ee58dda55c4939bf954a902aa6351b410051e2f56ed7d4147099