Analysis

  • max time kernel
    50s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02-07-2024 21:55

General

  • Target

    45158aea8f80f17dae1249c38050ba3da41844552ae9a34ee318849644ea7137.xls

  • Size

    46KB

  • MD5

    d3a55f7c8fbb2093ef06a2c95554e60d

  • SHA1

    b7ade7daa917334728560c2303d17fc43953b501

  • SHA256

    45158aea8f80f17dae1249c38050ba3da41844552ae9a34ee318849644ea7137

  • SHA512

    ecb0e782752669b3ca807e19c7c00caead08f87b4f1eeab83d6618d9d9d3b4a0c40b00ca2b0ea9163bfdbb30831cabf09bb6578802cc08fda5413a6628225bfe

  • SSDEEP

    768:VAyGhcjSFsv66g3KnFil/vQY54kkGfn+cW33YAMIN4jQEioD+IHe1dIN0AUx+mnF:WSSFsv66g3KnFil/vQY54kkGfn+cW337

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\45158aea8f80f17dae1249c38050ba3da41844552ae9a34ee318849644ea7137.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2332-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2332-1-0x000000007259D000-0x00000000725A8000-memory.dmp

    Filesize

    44KB

  • memory/2332-8-0x0000000006830000-0x0000000006930000-memory.dmp

    Filesize

    1024KB

  • memory/2332-9-0x000000007259D000-0x00000000725A8000-memory.dmp

    Filesize

    44KB

  • memory/2332-10-0x0000000006830000-0x0000000006930000-memory.dmp

    Filesize

    1024KB