Analysis

  • max time kernel
    47s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 08:06

General

  • Target

    969345890993fdbe3ef963e5a4cbdcd59308045e7d282ec4abfc7b8f6ad0e393.xls

  • Size

    44KB

  • MD5

    67296eff5132c8c2a92ca8da31b71673

  • SHA1

    502dd4f37e93eccd5c1172fc61251e9c2440008e

  • SHA256

    969345890993fdbe3ef963e5a4cbdcd59308045e7d282ec4abfc7b8f6ad0e393

  • SHA512

    9f26ada5940853d26e9c4aa02ff367227f00ec6f92bf9a7153e9ec44a3b07b322a1415224b505ac2908a83d3503a38b7899ec333c343152547ade9a7a8239e6f

  • SSDEEP

    768:8hNNOwysyAh/9PXx3f5vVXpwCIuw67co9xEtjPOtioVjDGUU1qfDlaGGx+jDYIxH:KOwysyAh/9PXx3f5vVXpwCIuw67co9xN

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\969345890993fdbe3ef963e5a4cbdcd59308045e7d282ec4abfc7b8f6ad0e393.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4352-0-0x00007FFD893F0000-0x00007FFD89400000-memory.dmp

    Filesize

    64KB

  • memory/4352-1-0x00007FFD893F0000-0x00007FFD89400000-memory.dmp

    Filesize

    64KB

  • memory/4352-2-0x00007FFD893F0000-0x00007FFD89400000-memory.dmp

    Filesize

    64KB

  • memory/4352-4-0x00007FFDC940D000-0x00007FFDC940E000-memory.dmp

    Filesize

    4KB

  • memory/4352-3-0x00007FFD893F0000-0x00007FFD89400000-memory.dmp

    Filesize

    64KB

  • memory/4352-5-0x00007FFD893F0000-0x00007FFD89400000-memory.dmp

    Filesize

    64KB

  • memory/4352-7-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-6-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-9-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-8-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-10-0x00007FFD87390000-0x00007FFD873A0000-memory.dmp

    Filesize

    64KB

  • memory/4352-11-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-13-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-14-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-12-0x00007FFD87390000-0x00007FFD873A0000-memory.dmp

    Filesize

    64KB

  • memory/4352-16-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-15-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-18-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-17-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-31-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-32-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-34-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-33-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-35-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-46-0x00007FFDC9370000-0x00007FFDC9565000-memory.dmp

    Filesize

    2.0MB