Analysis

  • max time kernel
    865s
  • max time network
    841s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13-06-2024 07:23

General

  • Target

    file1.xlsm

  • Size

    38KB

  • MD5

    ac9f06fe9df388eb7bb593f0ddf3a304

  • SHA1

    73bf01daa5a2c204bde31ca65b27cb4b71185c44

  • SHA256

    429503b9474908ff3f001a224d45fb3397fc60252b9c2025f2453df02bbef3da

  • SHA512

    9139a09839e8bb28c759e8b1371c2b112e9ad49c6141ce7f6d65b375d7dc829b389f304128584708808a79731d0371bc795ce90dc0a232a0fc77e7644db6bce3

  • SSDEEP

    768:Y1YEzJ7utTytMcCpp/txkw30Zpw5JZTVi73xmOAyfJdPi9/0YLv4B:Y1397upDcCpJtj0ZO5J/uvAyfJdaU

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\file1.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4500-0-0x00007FF89C630000-0x00007FF89C640000-memory.dmp

    Filesize

    64KB

  • memory/4500-1-0x00007FF8DC645000-0x00007FF8DC646000-memory.dmp

    Filesize

    4KB

  • memory/4500-3-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-5-0x00007FF89C630000-0x00007FF89C640000-memory.dmp

    Filesize

    64KB

  • memory/4500-8-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-4-0x00007FF89C630000-0x00007FF89C640000-memory.dmp

    Filesize

    64KB

  • memory/4500-10-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-9-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-11-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-2-0x00007FF89C630000-0x00007FF89C640000-memory.dmp

    Filesize

    64KB

  • memory/4500-12-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-13-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-16-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-17-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-18-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-15-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-14-0x00007FF899560000-0x00007FF899570000-memory.dmp

    Filesize

    64KB

  • memory/4500-19-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-21-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-20-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-22-0x00007FF899560000-0x00007FF899570000-memory.dmp

    Filesize

    64KB

  • memory/4500-208-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB

  • memory/4500-209-0x00007FF8DC645000-0x00007FF8DC646000-memory.dmp

    Filesize

    4KB

  • memory/4500-210-0x00007FF8DC5A0000-0x00007FF8DC77B000-memory.dmp

    Filesize

    1.9MB