Analysis

  • max time kernel
    50s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02-07-2024 21:52

General

  • Target

    5d2e50fd29c9d8dc23817bd5e4ba68f9fb99a10d96cbece549179c912b8016e7.xls

  • Size

    42KB

  • MD5

    af8d22bdb598e028aa8ff51956740969

  • SHA1

    ab503500db84de5f1c8a9676beeab6ee6faf2efe

  • SHA256

    5d2e50fd29c9d8dc23817bd5e4ba68f9fb99a10d96cbece549179c912b8016e7

  • SHA512

    f28a7bed0ab844efd42bfa3c27c17a09fd5629b8f3774172a295dffa21414d1e824c08be3a4058316a8eb4644e005116612bb89c5551292ed5c4d704f1dc5744

  • SSDEEP

    768:ibUek3hOdsylKlgryzc4bNhZFGzE+cL4LgldWgxMzjuDBg8l0VACT:8k3hOdsylKlgryzc4bNhZFGzE+cL4Lg+

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\5d2e50fd29c9d8dc23817bd5e4ba68f9fb99a10d96cbece549179c912b8016e7.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2440-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2440-1-0x0000000072C9D000-0x0000000072CA8000-memory.dmp

    Filesize

    44KB

  • memory/2440-3-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/2440-2-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/2440-4-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/2440-5-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/2440-6-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/2440-9-0x0000000072C9D000-0x0000000072CA8000-memory.dmp

    Filesize

    44KB

  • memory/2440-10-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB