Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 01:14

General

  • Target

    7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll

  • Size

    820KB

  • MD5

    0645646e6a417573d0047b6084e4632a

  • SHA1

    d43adf73470cb151a61482d2e5d87f3fa1420717

  • SHA256

    7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f

  • SHA512

    36daebde0a113fae75301f4b3bc09860b6c17788e3f132cd25cf66b1d6b726bf6df4ba80add24009bc1d5fb566359d3e4be6d54456fbbe733059e106f5878f87

  • SSDEEP

    12288:BG1N4HkcgMsiOd58bzbBSrePQ0uqZzD1reWabd/T7ppePgEKB9S4566Gwa:BoOOMX1/+QHT+d77ppqWB9S4Q6y

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\7c43077f843fcf5ad00e36587087929c73702171bfb36e4c5007ea54df09e37f.xll

    Filesize

    128KB

    MD5

    d1b295d2e9da728e091766779d594b14

    SHA1

    eaf467bb3b7a1d6b588fe7bce40f8841acf45343

    SHA256

    a93444b1d37a6f8282f1de7d484637d9e4a377a95df937e0c449861119976ddc

    SHA512

    90a1637b334d6b0f6052b4a4185ec3cf4915fc2721474eb11577cdbd1780d026d4643f768bbe50d0be388d3c3ad67b00e75c4524d4eec52d593c37563559df63

  • memory/2172-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2172-1-0x0000000071EBD000-0x0000000071EC8000-memory.dmp

    Filesize

    44KB

  • memory/2172-3-0x0000000071EBD000-0x0000000071EC8000-memory.dmp

    Filesize

    44KB

  • memory/2172-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2172-5-0x0000000071EBD000-0x0000000071EC8000-memory.dmp

    Filesize

    44KB