Analysis

  • max time kernel
    47s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 07:35

General

  • Target

    e51de11ea907cd30d3e23b2fba41db97e5b8e6a09fac5598e558169addae508e.xls

  • Size

    172KB

  • MD5

    683c756c5d4b84c12071a9848635aa30

  • SHA1

    d4fd9fa1abbd12df8ed0951f8135c92f743f4c93

  • SHA256

    e51de11ea907cd30d3e23b2fba41db97e5b8e6a09fac5598e558169addae508e

  • SHA512

    ba39032e34eca9fc43d7996c6bc764681367634d263e3ef88f3eaa790323cf92b6305a4dc8176cbf0395d94d00fc40ef43dd7c3d8790641d38f3ce9f0e9a7fae

  • SSDEEP

    3072:sBVUpjDqF+wRjh4C+7UisD9q4z8kmODkACo0yAZjVurXn4Zbn8AhN6VJR10hI4Ws:kVUpjDqF+wRjh4C+7UisD9q4z8kmODk/

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e51de11ea907cd30d3e23b2fba41db97e5b8e6a09fac5598e558169addae508e.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\authorization.xls

    Filesize

    24KB

    MD5

    adc2df70a22590ab2133fc2b56687380

    SHA1

    469a5953a6a0b0e2b7cb3b0d69e6749a674bdde6

    SHA256

    65e1f494cb72916c49cb6da0ac38bc1b220025989aafdd0a101e5710c5fd739d

    SHA512

    f3306a4babdc9217257df25aafdccc0ae68402b664b3c8c830402c914d14ceec00f6e0bec2b09e7e42ec741bb11daeadd730b3f8c1e550a41e2607ca71729c2d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    274B

    MD5

    af22f4e0ca2a614683c583811f0de94d

    SHA1

    1531eb42a4decb4b538f25e5737597aebc2d7892

    SHA256

    5159f788713c2367370385b14113a4c54724c32d5e4d2da555d8581e35f134b6

    SHA512

    aa6d83c63493d3382504c020bb8209c6319ad8e8dbac9236678928d540ca5ac70a57bb671761af48fb2adcc72d8ac1db1529a825efd149d54ea6f0bbf7efa38a

  • memory/4888-20-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-225-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-0-0x00007FFCD6B90000-0x00007FFCD6BA0000-memory.dmp

    Filesize

    64KB

  • memory/4888-5-0x00007FFCD6B90000-0x00007FFCD6BA0000-memory.dmp

    Filesize

    64KB

  • memory/4888-7-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-6-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-9-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-12-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-11-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-13-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-14-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-16-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-2-0x00007FFCD6B90000-0x00007FFCD6BA0000-memory.dmp

    Filesize

    64KB

  • memory/4888-4-0x00007FFCD6B90000-0x00007FFCD6BA0000-memory.dmp

    Filesize

    64KB

  • memory/4888-1-0x00007FFD16BAD000-0x00007FFD16BAE000-memory.dmp

    Filesize

    4KB

  • memory/4888-17-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-15-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-10-0x00007FFCD43C0000-0x00007FFCD43D0000-memory.dmp

    Filesize

    64KB

  • memory/4888-8-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-40-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-3-0x00007FFCD6B90000-0x00007FFCD6BA0000-memory.dmp

    Filesize

    64KB

  • memory/4888-19-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-221-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-222-0x00007FFD16BAD000-0x00007FFD16BAE000-memory.dmp

    Filesize

    4KB

  • memory/4888-223-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-224-0x00007FFD16B10000-0x00007FFD16D05000-memory.dmp

    Filesize

    2.0MB

  • memory/4888-18-0x00007FFCD43C0000-0x00007FFCD43D0000-memory.dmp

    Filesize

    64KB