Analysis

  • max time kernel
    47s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-07-2024 21:52

General

  • Target

    5d2e50fd29c9d8dc23817bd5e4ba68f9fb99a10d96cbece549179c912b8016e7.xls

  • Size

    42KB

  • MD5

    af8d22bdb598e028aa8ff51956740969

  • SHA1

    ab503500db84de5f1c8a9676beeab6ee6faf2efe

  • SHA256

    5d2e50fd29c9d8dc23817bd5e4ba68f9fb99a10d96cbece549179c912b8016e7

  • SHA512

    f28a7bed0ab844efd42bfa3c27c17a09fd5629b8f3774172a295dffa21414d1e824c08be3a4058316a8eb4644e005116612bb89c5551292ed5c4d704f1dc5744

  • SSDEEP

    768:ibUek3hOdsylKlgryzc4bNhZFGzE+cL4LgldWgxMzjuDBg8l0VACT:8k3hOdsylKlgryzc4bNhZFGzE+cL4Lg+

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5d2e50fd29c9d8dc23817bd5e4ba68f9fb99a10d96cbece549179c912b8016e7.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4524-0-0x00007FFA51C70000-0x00007FFA51C80000-memory.dmp

    Filesize

    64KB

  • memory/4524-2-0x00007FFA51C70000-0x00007FFA51C80000-memory.dmp

    Filesize

    64KB

  • memory/4524-3-0x00007FFA51C70000-0x00007FFA51C80000-memory.dmp

    Filesize

    64KB

  • memory/4524-1-0x00007FFA51C70000-0x00007FFA51C80000-memory.dmp

    Filesize

    64KB

  • memory/4524-4-0x00007FFA91C8D000-0x00007FFA91C8E000-memory.dmp

    Filesize

    4KB

  • memory/4524-5-0x00007FFA51C70000-0x00007FFA51C80000-memory.dmp

    Filesize

    64KB

  • memory/4524-7-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-6-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-13-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-12-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-15-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-16-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-14-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-17-0x00007FFA4F410000-0x00007FFA4F420000-memory.dmp

    Filesize

    64KB

  • memory/4524-18-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-11-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-10-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-9-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-8-0x00007FFA4F410000-0x00007FFA4F420000-memory.dmp

    Filesize

    64KB

  • memory/4524-19-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-32-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-33-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-34-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-45-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-46-0x00007FFA91BF0000-0x00007FFA91DE5000-memory.dmp

    Filesize

    2.0MB