Analysis

  • max time kernel
    0s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2023 10:54

General

  • Target

    3342624c6c8c4f5dab93bbb40aa8fda9.xlsm

  • Size

    212KB

  • MD5

    3342624c6c8c4f5dab93bbb40aa8fda9

  • SHA1

    21a01d739a80e45885206f083bb754228cc67c77

  • SHA256

    369d214980b7c6a0964f4b2a411544f751185346ac63c95601395115015ba93c

  • SHA512

    7ec3d73a3bb13fe64490602312398bd7b5e4f02bd59936fa0ff0a9fc910bb065a2d08a2db0b42da53a0cbc24de3e6808ccbc4d0bb570f6bb1fc529c208bc5a9c

  • SSDEEP

    6144:1ogkLjLh/2ecFrwTsuyAq1zWSkjVjQb17EWFtD:KDLZudukACo+tXR

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3342624c6c8c4f5dab93bbb40aa8fda9.xlsm"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4760
    • C:\Windows\SYSTEM32\MSHTA.exe
      MSHTA C:\ProgramData\TFpBSRTQVONuBcB.sct
      2⤵
      • Process spawned unexpected child process
      PID:3284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4760-0-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB

  • memory/4760-7-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-11-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-13-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-16-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-18-0x00007FF809810000-0x00007FF809820000-memory.dmp

    Filesize

    64KB

  • memory/4760-19-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-21-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-22-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-20-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-17-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-15-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-14-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-12-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-10-0x00007FF809810000-0x00007FF809820000-memory.dmp

    Filesize

    64KB

  • memory/4760-9-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-8-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-6-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-5-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB

  • memory/4760-4-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB

  • memory/4760-3-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-2-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB

  • memory/4760-1-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB

  • memory/4760-41-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-62-0x00007FF84B7F0000-0x00007FF84B9E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4760-61-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB

  • memory/4760-59-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB

  • memory/4760-60-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB

  • memory/4760-58-0x00007FF80B870000-0x00007FF80B880000-memory.dmp

    Filesize

    64KB