Overview
overview
10Static
static
104072025_1...ft.exe
windows10-2004-x64
10ExamplesJe...ed.xls
windows10-2004-x64
1TvcomFreig...rs.xls
windows10-2004-x64
1TvcomFreig...es.xls
windows10-2004-x64
1TvcomFreight/Euro.xls
windows10-2004-x64
1TvcomFreig...er.xls
windows10-2004-x64
1TvcomFreig...on.xls
windows10-2004-x64
1TvcomFreight/V.xls
windows10-2004-x64
1Analysis
-
max time kernel
107s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20250619-en -
resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
04072025_1206_ChristopherCraft.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
ExamplesJennifer/Enjoyed.xls
Resource
win10v2004-20250619-en
Behavioral task
behavioral3
Sample
TvcomFreight/Browsers.xls
Resource
win10v2004-20250610-en
Behavioral task
behavioral4
Sample
TvcomFreight/Closes.xls
Resource
win10v2004-20250619-en
Behavioral task
behavioral5
Sample
TvcomFreight/Euro.xls
Resource
win10v2004-20250610-en
Behavioral task
behavioral6
Sample
TvcomFreight/Observer.xls
Resource
win10v2004-20250610-en
Behavioral task
behavioral7
Sample
TvcomFreight/Opinion.xls
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
TvcomFreight/V.xls
Resource
win10v2004-20250502-en
General
-
Target
TvcomFreight/Closes.xls
-
Size
87KB
-
MD5
ca026bf277621b9558c201d296aff9fa
-
SHA1
50b4aec1db438a0abe70d1e3870b45948f9e9492
-
SHA256
040c31e1dd4726b2c22f7ceba9a613fa13b31d5a5ec665f0fe7167e2b060a8a0
-
SHA512
ed018c8e0d4c1fed340cc31c5014e1e9ae6b113922acdfa72bc0bc208925b830e8380a535484e7b2f8ba08d581a66ce9672e03a64c9c161a3cae46645ae9ae0e
-
SSDEEP
1536:tC7C3TRUQLvqSmK2FYno9l3KsSCSZsWz8pORYdfs7o1S04:o7CD572FYtrCSZPOet8R4
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3012 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE 3012 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TvcomFreight\Closes.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize665B
MD50a9cef57b6ce635f6f9f378495439370
SHA116448cacac205df3d082d4185a0f9b5bcdb63a9b
SHA25676ebea0f1d89368b6238212b3caaa854859984e9e190167520e9717ab99fe9d5
SHA51202c597b34832a72a5519656b62b221db4351ab9d97f3e6ff7fa58f780a121cfcf7cc0e356fcde1c8ef8394f7ba4c886654f40228b0c1db2caeaafec2baac2f96