Analysis
-
max time kernel
12s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 03:01
Static task
static1
Behavioral task
behavioral1
Sample
ec5062b6c5c6648b188b29b28741d4911a36986ec5adccad8ecffa5e8b41734b.xls
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ec5062b6c5c6648b188b29b28741d4911a36986ec5adccad8ecffa5e8b41734b.xls
Resource
win10v2004-20240226-en
General
-
Target
ec5062b6c5c6648b188b29b28741d4911a36986ec5adccad8ecffa5e8b41734b.xls
-
Size
49KB
-
MD5
de81ca904b88240d1bdf3e6ce5211367
-
SHA1
04b96d917496857a4e5cafd042e1594323437a5b
-
SHA256
ec5062b6c5c6648b188b29b28741d4911a36986ec5adccad8ecffa5e8b41734b
-
SHA512
c52d1d62b0c73527ed2d4ea2a93444b2904c3e91d8b3296300c9c87ee8d288b23e0f779b4f3851886c230c5be8e84b15ee456eea086a7070444c1049d5bb7373
-
SSDEEP
1536:hX682vSrL9JfQsZvYjOEpE0Ff9hZ+U04mjDP:hX682arL9Cd6unv
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2512 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
EXCEL.EXEpid process 2512 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEpid process 2512 EXCEL.EXE 2512 EXCEL.EXE 2512 EXCEL.EXE 2512 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ec5062b6c5c6648b188b29b28741d4911a36986ec5adccad8ecffa5e8b41734b.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2512
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵PID:1188