4ef27ff64d29a1464f90c41a7305a83b122cce03288e16c6a0319e5bfad46d74

Analysis

max time kernel
44s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ef27ff64d29a1464f90c41a7305a83b122cce03288e16c6a0319e5bfad46d74.xlsm
Size

92KB
MD5

a8bcc50bab6eb2ba3df72470233b5367
SHA1

3988a282cc2bf5ae2c50e10db1f786fadc01bf6b
SHA256

4ef27ff64d29a1464f90c41a7305a83b122cce03288e16c6a0319e5bfad46d74
SHA512

1e6e2b78d7e1bc802d8a8a3b04bb1df87ac56a1bee852a2150f6f10e69c663e5b22e808fc0e98b957d1241e19ae52780279373d03c0dfe68b2b490336fb29d94
SSDEEP

1536:CguZCa6S5khUIrJ1us1Dw/YzK4znOSjhLqxMUH9Ga/M1NIpPkUlB7583fjncFYIv:CgugapkhlF1uaUwOaPjpqxvD/Ms8ULas

Score

1^/10

Malware Config

Signatures

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3000	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3000	EXCEL.EXE
3000	EXCEL.EXE
3000	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\4ef27ff64d29a1464f90c41a7305a83b122cce03288e16c6a0319e5bfad46d74.xlsm
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3000-1-0x000000007269D000-0x00000000726A8000-memory.dmp

Filesize
44KB

Download
memory/3000-26-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-51-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-65-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-64-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-66-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-67-0x000000007269D000-0x00000000726A8000-memory.dmp

Filesize
44KB

Download
memory/3000-68-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-69-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-70-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-71-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download
memory/3000-72-0x0000000005ED0000-0x0000000005FD0000-memory.dmp

Filesize
1024KB

Download