Resubmissions

28/02/2024, 14:09

240228-rgcsesdd86 1

28/02/2024, 14:08

240228-rfmagadd74 1

28/02/2024, 14:06

240228-retm6add9w 1

Analysis

  • max time kernel
    97s
  • max time network
    110s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-it
  • resource tags

    arch:x64arch:x86image:win10-20240221-itlocale:it-itos:windows10-1703-x64systemwindows
  • submitted
    28/02/2024, 14:09

General

  • Target

    a9d81db31f2e267c8e04e1045246e9aaa13ea4f0267c5eb4e80ac2dbc6831838.xls

  • Size

    90KB

  • MD5

    9a95aa0c43875fc92d98796992121ae6

  • SHA1

    2b8b3d6e105e2e8a40f35834a179457518911f86

  • SHA256

    a9d81db31f2e267c8e04e1045246e9aaa13ea4f0267c5eb4e80ac2dbc6831838

  • SHA512

    0eb454752c318b2c8275533a1cbbbdf7b7de8f13015524f41894a8fab39fddf5d4282c08ae64615a200f6aa4bf263f18877caaed0a7aacf5b290fbe4b4642a30

  • SSDEEP

    1536:VsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm02PSJHN4C1bvBm0AlxjkLFSyXO:VhlYkEIuPm3fNRZmbaoFhZhR0cixIHm/

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a9d81db31f2e267c8e04e1045246e9aaa13ea4f0267c5eb4e80ac2dbc6831838.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4344

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4344-0-0x00007FFA74830000-0x00007FFA74840000-memory.dmp

          Filesize

          64KB

        • memory/4344-2-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-3-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-1-0x00007FFA74830000-0x00007FFA74840000-memory.dmp

          Filesize

          64KB

        • memory/4344-5-0x00007FFA74830000-0x00007FFA74840000-memory.dmp

          Filesize

          64KB

        • memory/4344-6-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-8-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-4-0x00007FFA74830000-0x00007FFA74840000-memory.dmp

          Filesize

          64KB

        • memory/4344-10-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-11-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-12-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-13-0x00007FFAB4430000-0x00007FFAB44DE000-memory.dmp

          Filesize

          696KB

        • memory/4344-14-0x00007FFAB4430000-0x00007FFAB44DE000-memory.dmp

          Filesize

          696KB

        • memory/4344-15-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-16-0x00007FFA71360000-0x00007FFA71370000-memory.dmp

          Filesize

          64KB

        • memory/4344-17-0x00007FFA71360000-0x00007FFA71370000-memory.dmp

          Filesize

          64KB

        • memory/4344-344-0x000002404F6C0000-0x000002404FEC0000-memory.dmp

          Filesize

          8.0MB

        • memory/4344-350-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-351-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-352-0x00007FFAB4430000-0x00007FFAB44DE000-memory.dmp

          Filesize

          696KB

        • memory/4344-356-0x00007FFAB47A0000-0x00007FFAB497B000-memory.dmp

          Filesize

          1.9MB

        • memory/4344-357-0x000002404F6C0000-0x000002404FEC0000-memory.dmp

          Filesize

          8.0MB