Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 23:19

General

  • Target

    9288476092f8b496b301dc6887513ca3d2aa0fab7ff3cded8d8bb63867a195bc.xlsx

  • Size

    29KB

  • MD5

    4095ae90661c7b946a7c1afe51d56e86

  • SHA1

    4e121f82013dd4640087de43f3be55a9ea340680

  • SHA256

    9288476092f8b496b301dc6887513ca3d2aa0fab7ff3cded8d8bb63867a195bc

  • SHA512

    fa2220fdae0e6e5df6e3e3d1a15e6580a9c7ac91bd64ffdb06f1d68a2e49dc8bc23576ac4d2fc0f11ad2e6e127b8261ac5a9284991acc2617e2bc449598f8887

  • SSDEEP

    768:wnEQpllh7tAafroiianGoHoJ+yWWn0WhtNO:nQJh7Lro4ntD+0ANO

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9288476092f8b496b301dc6887513ca3d2aa0fab7ff3cded8d8bb63867a195bc.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3720

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3720-2-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-1-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-4-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-3-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-5-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-6-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-0-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-8-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-7-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-10-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-11-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-12-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-9-0x00007FFA02170000-0x00007FFA02180000-memory.dmp

          Filesize

          64KB

        • memory/3720-13-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-14-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-16-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-17-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-19-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-21-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-22-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-23-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-20-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-18-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-15-0x00007FFA02170000-0x00007FFA02180000-memory.dmp

          Filesize

          64KB

        • memory/3720-36-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB

        • memory/3720-53-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-54-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-56-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-55-0x00007FFA046B0000-0x00007FFA046C0000-memory.dmp

          Filesize

          64KB

        • memory/3720-57-0x00007FFA44630000-0x00007FFA44825000-memory.dmp

          Filesize

          2.0MB