Analysis

  • max time kernel
    123s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:44

General

  • Target

    752030ebdbbb2a06049d1e4dcfbf51cf.xls

  • Size

    25KB

  • MD5

    752030ebdbbb2a06049d1e4dcfbf51cf

  • SHA1

    61b1a4b6186c3c5c586b5bbc00dbaa37bf112d0f

  • SHA256

    3a9480a72ed178b05f935994b95953f2ae6cd9f3402358e1ea5c626302d43694

  • SHA512

    08ffcfa864af4e069d52d2e09ae36b354e6f82c4af24377a4427e4ba41e3937b3e75ebb27647c7816a083e76016fd45b032e6cb56e23ab8efe08cd0e55d1310d

  • SSDEEP

    384:K6R8lJfuAjFuki4ioV6aGOp6VK8uAbGz+fa5x0ergjP5IEbQk:K6R8HmAjFuki4i0GNKabGzGLFHQk

Score
10/10

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\752030ebdbbb2a06049d1e4dcfbf51cf.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/472-0-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-2-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-3-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-4-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-5-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-1-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-6-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-7-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-8-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-9-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-10-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-11-0x00007FF9595C0000-0x00007FF9595D0000-memory.dmp

    Filesize

    64KB

  • memory/472-12-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-13-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-14-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-15-0x00007FF9595C0000-0x00007FF9595D0000-memory.dmp

    Filesize

    64KB

  • memory/472-29-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-30-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-45-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-46-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-48-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-47-0x00007FF95BC30000-0x00007FF95BC40000-memory.dmp

    Filesize

    64KB

  • memory/472-49-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB

  • memory/472-50-0x00007FF99BBB0000-0x00007FF99BDA5000-memory.dmp

    Filesize

    2.0MB