Analysis

  • max time kernel
    46s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 03:46

General

  • Target

    0f8c21a07bda2c72b46dcba3a2b48f1f4ff970e26c036055093c4d26fb1d0fe0.xls

  • Size

    69KB

  • MD5

    b781044d9ee903d90ad7cae316db953f

  • SHA1

    0fbcfc58ba608cf6f3ef3d3b44f0262343917041

  • SHA256

    0f8c21a07bda2c72b46dcba3a2b48f1f4ff970e26c036055093c4d26fb1d0fe0

  • SHA512

    016b7cecaf2f47d2b9c04d1682712264fbf7078d03262029737d9cc0cf5ea8c283a8e6e51858c1b96a82bdcdf18993f5853def9e83cf3383bae421de20b12c9e

  • SSDEEP

    1536:rRk3hOdsylKlgryzc4bNhZFGzE+cL/gE07YJuj1iCiNzZTL8Gtsx:rRk3hOdsylKlgryzc4bNhZFGzE+cL/gt

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0f8c21a07bda2c72b46dcba3a2b48f1f4ff970e26c036055093c4d26fb1d0fe0.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2244
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:4676

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3452-0-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

        Filesize

        64KB

      • memory/3452-2-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

        Filesize

        64KB

      • memory/3452-1-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

        Filesize

        64KB

      • memory/3452-3-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

        Filesize

        64KB

      • memory/3452-4-0x00007FFF16CED000-0x00007FFF16CEE000-memory.dmp

        Filesize

        4KB

      • memory/3452-6-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

        Filesize

        64KB

      • memory/3452-5-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

        Filesize

        2.0MB

      • memory/3452-9-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

        Filesize

        2.0MB

      • memory/3452-8-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

        Filesize

        2.0MB

      • memory/3452-7-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

        Filesize

        2.0MB

      • memory/3452-11-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

        Filesize

        2.0MB

      • memory/3452-10-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

        Filesize

        2.0MB

      • memory/3452-12-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

        Filesize

        2.0MB

      • memory/3452-13-0x00007FFED4BE0000-0x00007FFED4BF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-14-0x00007FFED4BE0000-0x00007FFED4BF0000-memory.dmp

        Filesize

        64KB

      • memory/3452-37-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

        Filesize

        2.0MB