Overview
overview
10Static
static
104072025_1...ft.exe
windows10-2004-x64
10ExamplesJe...ed.xls
windows10-2004-x64
1TvcomFreig...rs.xls
windows10-2004-x64
1TvcomFreig...es.xls
windows10-2004-x64
1TvcomFreight/Euro.xls
windows10-2004-x64
1TvcomFreig...er.xls
windows10-2004-x64
1TvcomFreig...on.xls
windows10-2004-x64
1TvcomFreight/V.xls
windows10-2004-x64
1Analysis
-
max time kernel
158s -
max time network
282s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
04072025_1206_ChristopherCraft.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
ExamplesJennifer/Enjoyed.xls
Resource
win10v2004-20250619-en
Behavioral task
behavioral3
Sample
TvcomFreight/Browsers.xls
Resource
win10v2004-20250610-en
Behavioral task
behavioral4
Sample
TvcomFreight/Closes.xls
Resource
win10v2004-20250619-en
Behavioral task
behavioral5
Sample
TvcomFreight/Euro.xls
Resource
win10v2004-20250610-en
Behavioral task
behavioral6
Sample
TvcomFreight/Observer.xls
Resource
win10v2004-20250610-en
Behavioral task
behavioral7
Sample
TvcomFreight/Opinion.xls
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
TvcomFreight/V.xls
Resource
win10v2004-20250502-en
General
-
Target
TvcomFreight/V.xls
-
Size
71KB
-
MD5
dd293664223c227fa5a3502f021449cb
-
SHA1
5a91a61c061f3e148e65c06e2f9bd5ebea131327
-
SHA256
4b68746f26924785b0648f91b165808d06b9ce74e6f07f69b2a634728923b784
-
SHA512
5efff838a94a15def500819bfc7d21e2f77330eb2e3c262bad521f5f1aaa9db9634e37cbc2e6bb03781a20fa463fd431c79fb06a358b9d9c2c8c41bc36b5a8de
-
SSDEEP
1536:6c1vcg+xNKZhh4iBUwf6qHx6Fir9chwcE21E4ixrEwq4hbWXCVl:6O+uZhh/BPkkTr4sEwq+b8Y
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 688 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE 688 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TvcomFreight\V.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize4KB
MD5836be97943aaaea04b5ff2b6333341e1
SHA153827fb50d09d9544717a13d270e75be741c53b4
SHA256aa4ad080754c8cfa5aa5abfae18bffc8ae389d47678953cfe5cf487da39cdb47
SHA5129aed8f8b4e349d3121bad8047b355eaeb5dee3892d26cf70ecbc6ca0b5dbb56004dbccc4f4994c84fd6540c6185198bb46b15b6970e16b6678fe3ee37d796e1b