Analysis

  • max time kernel
    46s
  • max time network
    33s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 21:37

General

  • Target

    420f8c95d5cdd6a6e060cb5b0f820405e625cb9d34300b62c4364eeca93d8c47.xlsm

  • Size

    92KB

  • MD5

    2b96a26837c8241e01d39df3675b77d3

  • SHA1

    bb3181e554cb36ec67f280ccd03e2501ed92d61d

  • SHA256

    420f8c95d5cdd6a6e060cb5b0f820405e625cb9d34300b62c4364eeca93d8c47

  • SHA512

    685fb3f3303425610bcb9f40fd88fa052deb1b79def6051cb61f8713d1322d337e77ff7127af4f275c7805901065ba088b62e9db61fac192c6cdb6062d17e337

  • SSDEEP

    1536:CguZCa6S5khUIyAJy4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIrrkFW:CgugapkhlyA8aPjpM+d/Ms8ULavLcA

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\420f8c95d5cdd6a6e060cb5b0f820405e625cb9d34300b62c4364eeca93d8c47.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2168

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2168-0-0x00007FFE9F0F0000-0x00007FFE9F100000-memory.dmp

          Filesize

          64KB

        • memory/2168-1-0x00007FFE9F0F0000-0x00007FFE9F100000-memory.dmp

          Filesize

          64KB

        • memory/2168-2-0x00007FFE9F0F0000-0x00007FFE9F100000-memory.dmp

          Filesize

          64KB

        • memory/2168-4-0x00007FFE9F0F0000-0x00007FFE9F100000-memory.dmp

          Filesize

          64KB

        • memory/2168-3-0x00007FFE9F0F0000-0x00007FFE9F100000-memory.dmp

          Filesize

          64KB

        • memory/2168-5-0x00007FFEDF10D000-0x00007FFEDF10E000-memory.dmp

          Filesize

          4KB

        • memory/2168-7-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-6-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-8-0x00007FFE9C790000-0x00007FFE9C7A0000-memory.dmp

          Filesize

          64KB

        • memory/2168-9-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-10-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-11-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-12-0x00007FFE9C790000-0x00007FFE9C7A0000-memory.dmp

          Filesize

          64KB

        • memory/2168-14-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-15-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-17-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-19-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-18-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-16-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-13-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB

        • memory/2168-149-0x00007FFEDF070000-0x00007FFEDF265000-memory.dmp

          Filesize

          2.0MB