Analysis

  • max time kernel
    30s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 21:52

General

  • Target

    0cef678bdd35846330c9e78535e515362e977ff33be8ad1d51758a6ba6cccf7e.xls

  • Size

    1.1MB

  • MD5

    a4affb65fb1cc8d8a69fad11a739ff96

  • SHA1

    e943117ca1640a42acae27b10a1b9a7b87c36b14

  • SHA256

    0cef678bdd35846330c9e78535e515362e977ff33be8ad1d51758a6ba6cccf7e

  • SHA512

    3d2d29f6ef24509b125be9f3b12a7d9567e7c57c545e68b414e999200bd2cf51337d76de8ee8cf0e4b4ff788bb91309b441c1f64267783e3ab4addab787fe627

  • SSDEEP

    12288:THlhouZAzb8KplK8LhjeqS9y5qKiVUtmNrZiWyqJ58p3VNhB0SDY22JsdmcF:THQuev8KlK8LhjeqS9y5qKmUMNr/5+

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\0cef678bdd35846330c9e78535e515362e977ff33be8ad1d51758a6ba6cccf7e.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\VB81B0.tmp

    Filesize

    1KB

    MD5

    12a2cc01237adbabc8c5378a30389571

    SHA1

    098a84243ad7e0d2e4ac484a4e666c482cd41375

    SHA256

    b426b49e4ac38253a600a06c9da1532830b42e8a44175da068f7406447259fac

    SHA512

    19318d65c66d8eed758c770d4a43ae63de875bae4c9c415e56ef7745c06e7890edda1e4412261851ebdd628737efd8cc3033bbd5f63206578a21bf9d91f5f827

  • memory/2264-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2264-1-0x0000000072C5D000-0x0000000072C68000-memory.dmp

    Filesize

    44KB

  • memory/2264-2-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/2264-4-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/2264-6-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/2264-3-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/2264-7-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/2264-9-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/2264-32-0x0000000072C5D000-0x0000000072C68000-memory.dmp

    Filesize

    44KB

  • memory/2264-33-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/2264-34-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB