6fa5b8e1edb2f6122707560906449fdafbec113b4db848df3bae5be074862524

Analysis

max time kernel
0s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6f0179c007025945395ebecfc95a978.xlsm
Size

41KB
MD5

f6f0179c007025945395ebecfc95a978
SHA1

e1b4de8cce14257452a096154b2048c5662b34e9
SHA256

6fa5b8e1edb2f6122707560906449fdafbec113b4db848df3bae5be074862524
SHA512

bc0278e21e27cf37e35588aa97bc4d38ef681eb7c03d9841c9c52ce735644bc0d792371299a8ed405aa20172660d28d83b84624a57568f0d342bf111f8261205
SSDEEP

768:46xbfxvarZN0DGCfkyX3eks4pSGn0Qic3qCF35GbBNeDOK:46jMGzfPeUv021JG3y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\f6f0179c007025945395ebecfc95a978.xlsm
1⤵
- Modifies Internet Explorer settings
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-1-0x000000007212D000-0x0000000072138000-memory.dmp

Filesize
44KB

Download
memory/624-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/624-2-0x000000007212D000-0x0000000072138000-memory.dmp

Filesize
44KB

Download
memory/624-6-0x000000007212D000-0x0000000072138000-memory.dmp

Filesize
44KB

Download
memory/624-5-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download