Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2024 17:44

General

  • Target

    752030ebdbbb2a06049d1e4dcfbf51cf.xls

  • Size

    25KB

  • MD5

    752030ebdbbb2a06049d1e4dcfbf51cf

  • SHA1

    61b1a4b6186c3c5c586b5bbc00dbaa37bf112d0f

  • SHA256

    3a9480a72ed178b05f935994b95953f2ae6cd9f3402358e1ea5c626302d43694

  • SHA512

    08ffcfa864af4e069d52d2e09ae36b354e6f82c4af24377a4427e4ba41e3937b3e75ebb27647c7816a083e76016fd45b032e6cb56e23ab8efe08cd0e55d1310d

  • SSDEEP

    384:K6R8lJfuAjFuki4ioV6aGOp6VK8uAbGz+fa5x0ergjP5IEbQk:K6R8HmAjFuki4i0GNKabGzGLFHQk

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\752030ebdbbb2a06049d1e4dcfbf51cf.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2024-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2024-1-0x00000000726CD000-0x00000000726D8000-memory.dmp

    Filesize

    44KB

  • memory/2024-3-0x00000000726CD000-0x00000000726D8000-memory.dmp

    Filesize

    44KB

  • memory/2024-5-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2024-6-0x00000000726CD000-0x00000000726D8000-memory.dmp

    Filesize

    44KB