00ef3596374047bd214a87926b7b462301f5c3e4bd5d976ca122688951a0b2f2

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SineeDriver-英文可执行文件(EM760)/SineeDriver-英文可执行文件(EM760)/SineeDriver_EN/Car.xlsx
Size

19KB
MD5

3b70bd7a2fd221492b56bfc7d0f2396a
SHA1

f67fd9464a4c03bdf049402d759e7a7af21e557c
SHA256

293297002c0d62a7d49586d89987958156d9023b2996fbe1a966b8522314ae5a
SHA512

1d09f3dc2a2b90f381c7402a6aa2dd70fcf93747da610264e0d99db418987885f35cbca323b17bad7c1baeb2f77cb2317f77bf7663e7524d53a29243946e6114
SSDEEP

384:lNfbdmTqyzx8Nxhq4da2XDpX53v2cyHxQC1Or:lQxt0xhDda2lJuZG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2488	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2488	EXCEL.EXE
2488	EXCEL.EXE
2488	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SineeDriver-英文可执行文件(EM760)\SineeDriver-英文可执行文件(EM760)\SineeDriver_EN\Car.xlsx
1⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2488-1-0x000000007365D000-0x0000000073668000-memory.dmp

Filesize
44KB

Download
memory/2488-2-0x000000007365D000-0x0000000073668000-memory.dmp

Filesize
44KB

Download
memory/2488-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2488-5-0x000000007365D000-0x0000000073668000-memory.dmp

Filesize
44KB

Download