Analysis

  • max time kernel
    47s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 21:31

General

  • Target

    dad0041bed8855ad7ff7f1b2fe337b91fededff83c5441948a4a62efb5a7ee55.xls

  • Size

    91KB

  • MD5

    7deb406672037a08a745d433f5277e66

  • SHA1

    135585e6219bd3c8577bd497090f5449d80827c4

  • SHA256

    dad0041bed8855ad7ff7f1b2fe337b91fededff83c5441948a4a62efb5a7ee55

  • SHA512

    a537bf6756cc4d7a6fbdf3d922cdc7565bfabb4c8a4d051b26ac15de80fb5116a095f05c15c26f65b1c14ca72ace530e0b873f4d461f7592d154dd2c7689c269

  • SSDEEP

    1536:hhpk3hOdsylKlgryzc4bNhZFGzE+cWgLg0dAm9Nk:Zk3hOdsylKlgryzc4bNhZFGzE+cWgLg+

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\dad0041bed8855ad7ff7f1b2fe337b91fededff83c5441948a4a62efb5a7ee55.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3628-0-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

  • memory/3628-2-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

  • memory/3628-1-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

  • memory/3628-3-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

  • memory/3628-7-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-5-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-6-0x00007FFA23AB0000-0x00007FFA23AC0000-memory.dmp

    Filesize

    64KB

  • memory/3628-4-0x00007FFA63ACD000-0x00007FFA63ACE000-memory.dmp

    Filesize

    4KB

  • memory/3628-10-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-9-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-14-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-13-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-15-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-16-0x00007FFA21920000-0x00007FFA21930000-memory.dmp

    Filesize

    64KB

  • memory/3628-18-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-19-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-17-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-12-0x00007FFA21920000-0x00007FFA21930000-memory.dmp

    Filesize

    64KB

  • memory/3628-11-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-8-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-39-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-40-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-41-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-42-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-43-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-49-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-50-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB

  • memory/3628-51-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

    Filesize

    2.0MB