Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2023 18:05
Static task
static1
Behavioral task
behavioral1
Sample
9f98445aee1b8b0538efb03bac801b51a61bc955d34847ab76fc9353ec7cdefcxls_JC.xls
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9f98445aee1b8b0538efb03bac801b51a61bc955d34847ab76fc9353ec7cdefcxls_JC.xls
Resource
win10v2004-20230703-en
General
-
Target
9f98445aee1b8b0538efb03bac801b51a61bc955d34847ab76fc9353ec7cdefcxls_JC.xls
-
Size
1.7MB
-
MD5
975ed2bdc3ce34050156fa02c18bc8f5
-
SHA1
db9aeb2a56b682271ba6725f891a9f48b834cb96
-
SHA256
9f98445aee1b8b0538efb03bac801b51a61bc955d34847ab76fc9353ec7cdefc
-
SHA512
e0938c22f2667c3d09da2797a13e7424c62104a9283c34cf4df5950dbc925ec0c3d0251f49bf58a2dbd919f715fc5c353805207414a3ff8b817158341080f717
-
SSDEEP
49152:bQmmQ30Pupp6VVQmmQ3085l6V8iNhv3tVfXCnSgk6+ib:bpmQkPamVpmQkKm8MhHCA6
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2616 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2616 EXCEL.EXE 2616 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE 2616 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9f98445aee1b8b0538efb03bac801b51a61bc955d34847ab76fc9353ec7cdefcxls_JC.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2616
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5a01b9617553432807b9b58025b338d97
SHA1439bdcc450408b9735b2428c2d53d2e6977fa58c
SHA2567a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce
SHA512312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee