Analysis
-
max time kernel
123s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 16:44
Static task
static1
Behavioral task
behavioral1
Sample
026b972cd5a3752844db26d1011e93933b00f15029f7aad5adae7a70637ef653xls_JC.xls
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
026b972cd5a3752844db26d1011e93933b00f15029f7aad5adae7a70637ef653xls_JC.xls
Resource
win10v2004-20230703-en
General
-
Target
026b972cd5a3752844db26d1011e93933b00f15029f7aad5adae7a70637ef653xls_JC.xls
-
Size
1.7MB
-
MD5
fa4202239f24244cc87b96f832cfcaf0
-
SHA1
06c574b6fdd23b0c966c5f1ffc05838cac3cfbd6
-
SHA256
026b972cd5a3752844db26d1011e93933b00f15029f7aad5adae7a70637ef653
-
SHA512
d2b725279f8461788da0634e92b14fe454fac7f3413e56fe7da6c07aa41618c79d6f579c22b163aab9a993df0d20a2058728a6d60abc023482665186de94f2ac
-
SSDEEP
49152:rQmmQ303upp6VnQmmQ3085N6V8iNhv3tS3fXCnSgk6+ib:rpmQk3amnpmQkGm8Mh2CA6
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2296 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2296 EXCEL.EXE 2296 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\026b972cd5a3752844db26d1011e93933b00f15029f7aad5adae7a70637ef653xls_JC.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2296
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5a01b9617553432807b9b58025b338d97
SHA1439bdcc450408b9735b2428c2d53d2e6977fa58c
SHA2567a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce
SHA512312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee