Analysis

  • max time kernel
    46s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-06-2024 10:53

General

  • Target

    60ae6e449ce1c8568fe4aff5aa012b94f143ea43552a9ba8408f70e585ce700b.xlsm

  • Size

    91KB

  • MD5

    1664d829b0514351bdcb1a1c9e735187

  • SHA1

    d309c2d311c48e6c8d425103c01b46c507310cb4

  • SHA256

    60ae6e449ce1c8568fe4aff5aa012b94f143ea43552a9ba8408f70e585ce700b

  • SHA512

    52cb4b05b70f09a9a5320de157a8ef75c08713d872c28c93472265e5053a71d4195a3912017c811554170649d6c49c5c95fbf56a369245b576bf88a0efabaf3a

  • SSDEEP

    1536:CguZCa6S5khUIj9VOn4znOSjhL97kGa/M1NIpPkUlB7583fjncFYII2Fv:CgugapkhljKnaPjpE/Ms8ULavLcH

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\60ae6e449ce1c8568fe4aff5aa012b94f143ea43552a9ba8408f70e585ce700b.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3808-4-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/3808-11-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-17-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-22-0x00007FFD29D70000-0x00007FFD29D80000-memory.dmp

    Filesize

    64KB

  • memory/3808-21-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-20-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-19-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-18-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-16-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-15-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-14-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-13-0x00007FFD29D70000-0x00007FFD29D80000-memory.dmp

    Filesize

    64KB

  • memory/3808-12-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-10-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-9-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-8-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-7-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-6-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-5-0x00007FFD6C34D000-0x00007FFD6C34E000-memory.dmp

    Filesize

    4KB

  • memory/3808-3-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/3808-1-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/3808-2-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/3808-0-0x00007FFD2C330000-0x00007FFD2C340000-memory.dmp

    Filesize

    64KB

  • memory/3808-66-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3808-161-0x00007FFD6C2B0000-0x00007FFD6C4A5000-memory.dmp

    Filesize

    2.0MB