Analysis

  • max time kernel
    44s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 08:06

General

  • Target

    969345890993fdbe3ef963e5a4cbdcd59308045e7d282ec4abfc7b8f6ad0e393.xls

  • Size

    44KB

  • MD5

    67296eff5132c8c2a92ca8da31b71673

  • SHA1

    502dd4f37e93eccd5c1172fc61251e9c2440008e

  • SHA256

    969345890993fdbe3ef963e5a4cbdcd59308045e7d282ec4abfc7b8f6ad0e393

  • SHA512

    9f26ada5940853d26e9c4aa02ff367227f00ec6f92bf9a7153e9ec44a3b07b322a1415224b505ac2908a83d3503a38b7899ec333c343152547ade9a7a8239e6f

  • SSDEEP

    768:8hNNOwysyAh/9PXx3f5vVXpwCIuw67co9xEtjPOtioVjDGUU1qfDlaGGx+jDYIxH:KOwysyAh/9PXx3f5vVXpwCIuw67co9xN

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\969345890993fdbe3ef963e5a4cbdcd59308045e7d282ec4abfc7b8f6ad0e393.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2416-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2416-1-0x0000000071F1D000-0x0000000071F28000-memory.dmp

    Filesize

    44KB

  • memory/2416-8-0x0000000006470000-0x0000000006570000-memory.dmp

    Filesize

    1024KB

  • memory/2416-9-0x0000000071F1D000-0x0000000071F28000-memory.dmp

    Filesize

    44KB

  • memory/2416-10-0x0000000006470000-0x0000000006570000-memory.dmp

    Filesize

    1024KB