Analysis

  • max time kernel
    135s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2024 13:51

General

  • Target

    urls review1.xlsx

  • Size

    22KB

  • MD5

    e42991b2840dacf6276cfda4e4d05e00

  • SHA1

    22203704de61689a3626463f5756da8653d3d8bb

  • SHA256

    79d9176a32815bf8ea2f04b4cfcccfb76e31a3938f05c50022f47acddeb86b50

  • SHA512

    01177b8e5ea055769fd80b5e2a6c9da908a733809a97f9601cfa5d9a279346760638cbde8ec0d50de06defb024e213e4c193ab2ed459fb91ce7dcf91d0f395f3

  • SSDEEP

    384:cpP/ZV1SpJdD75iuDAVWzSPb/1l4ASle7EVuYPNPsuUko:AMZNnqWzSPb/q8QVZPXUko

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\urls review1.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1632-0-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-1-0x00007FFD6048D000-0x00007FFD6048E000-memory.dmp

    Filesize

    4KB

  • memory/1632-3-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-4-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-2-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-6-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-8-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-7-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-5-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-9-0x00007FFD1DF60000-0x00007FFD1DF70000-memory.dmp

    Filesize

    64KB

  • memory/1632-10-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-11-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-13-0x00007FFD1DF60000-0x00007FFD1DF70000-memory.dmp

    Filesize

    64KB

  • memory/1632-12-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-15-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-14-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-17-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-18-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-16-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-33-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-34-0x00007FFD6048D000-0x00007FFD6048E000-memory.dmp

    Filesize

    4KB

  • memory/1632-50-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-52-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-51-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-53-0x00007FFD20470000-0x00007FFD20480000-memory.dmp

    Filesize

    64KB

  • memory/1632-54-0x00007FFD603F0000-0x00007FFD605E5000-memory.dmp

    Filesize

    2.0MB