Overview
overview
10Static
static
35af0f5b0ba...de.exe
windows7-x64
105af0f5b0ba...de.exe
windows10-2004-x64
10MihalyLeve...g.docx
windows7-x64
3MihalyLeve...g.docx
windows10-2004-x64
1Mihály Le...17.pdf
windows7-x64
3Mihály Le...17.pdf
windows10-2004-x64
3Mérések ...2.xlsx
windows7-x64
3Mérések ...2.xlsx
windows10-2004-x64
1Analysis
-
max time kernel
133s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2025, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
5af0f5b0bada5b7aaa681eddebc47734267af06eb39610590a625315f449d4de.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
5af0f5b0bada5b7aaa681eddebc47734267af06eb39610590a625315f449d4de.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
MihalyLevente_Vezetotrening.docx
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
MihalyLevente_Vezetotrening.docx
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
Mihály Levente_Tartalmi kivonat_2017.pdf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Mihály Levente_Tartalmi kivonat_2017.pdf
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
Mérések Co2 lézeres kezelésre_v2.xlsx
Resource
win7-20250207-en
Behavioral task
behavioral8
Sample
Mérések Co2 lézeres kezelésre_v2.xlsx
Resource
win10v2004-20250314-en
General
-
Target
Mérések Co2 lézeres kezelésre_v2.xlsx
-
Size
47KB
-
MD5
1f6317291ab6d7789947860ed92885d1
-
SHA1
bf7eac4d1e74aefa63f8104d541dd98f3e7a9e47
-
SHA256
a5fe7ab849f57ddbc0c03c783abe786caa21b174e6744bb87330217f0866b132
-
SHA512
46588d572787dbe0e4075764462cce4c16ccea54db6f088b292cc5256dcf76fd6e9112f584ad87b51f07d24f0e2d53ef24a7c335baf9d6c81b392fefc10559c7
-
SSDEEP
768:TPazaRvYNB1GrrfMQJ48HIz2FAIZ4kXS2PDjVr/N51M9OofTLHVqFxa0eSiT:WzadYT1MoRCIzEewl/NTMoWzVqFcbT
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3024 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE 3024 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Mérések Co2 lézeres kezelésre_v2.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5238a45e19649a95b72b1b61b573580e9
SHA1d6ff4f739db97626b4c6c781455a64bde8e6b753
SHA25618951e2593d186ffd915524ddeac25f5204e0f8e13a7bdebc49b798a2e4f61c5
SHA5124a0eb1ffb89dc4c95a9cd8582830f0ab60b940143ec75afcac5b1115a0544af2569037e9452e9d3ca685ec4b4e0314308ea45844609038e3d41e71f87057f891