Analysis

  • max time kernel
    50s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2024 21:11

General

  • Target

    fd44d3a0c6dd879431f0f90dc05232464038089cafcfc91c40818ffaede86bea.xls

  • Size

    79KB

  • MD5

    25a41b2bd997c62aac3a176ed09a449d

  • SHA1

    95dd53cee1325defdd3ec14fbefc6d366383944b

  • SHA256

    fd44d3a0c6dd879431f0f90dc05232464038089cafcfc91c40818ffaede86bea

  • SHA512

    a22f14a43431a3fa99fc9d029233925f75b800246f4fb27515e04a49d3936fdd55512f472d021511ac1b597407ac3a52fb033b8cc159c4619bf14d3f8c1127e4

  • SSDEEP

    768:m3JFW0Fnv0+s+fPXrZpe3YsCW6flqXrZp0ZCs83RWg7WiD3vHB:4sUrZpetCWwurZp0p84g7H

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fd44d3a0c6dd879431f0f90dc05232464038089cafcfc91c40818ffaede86bea.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4492-1-0x00007FFD1C730000-0x00007FFD1C740000-memory.dmp

    Filesize

    64KB

  • memory/4492-0-0x00007FFD1C730000-0x00007FFD1C740000-memory.dmp

    Filesize

    64KB

  • memory/4492-4-0x00007FFD1C730000-0x00007FFD1C740000-memory.dmp

    Filesize

    64KB

  • memory/4492-3-0x00007FFD1C730000-0x00007FFD1C740000-memory.dmp

    Filesize

    64KB

  • memory/4492-2-0x00007FFD1C730000-0x00007FFD1C740000-memory.dmp

    Filesize

    64KB

  • memory/4492-7-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-6-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-5-0x00007FFD5C74D000-0x00007FFD5C74E000-memory.dmp

    Filesize

    4KB

  • memory/4492-8-0x00007FFD19EE0000-0x00007FFD19EF0000-memory.dmp

    Filesize

    64KB

  • memory/4492-9-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-10-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-13-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-12-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-14-0x00007FFD19EE0000-0x00007FFD19EF0000-memory.dmp

    Filesize

    64KB

  • memory/4492-11-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-15-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-18-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-17-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-16-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-27-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-28-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-40-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-43-0x00007FFD5C6B0000-0x00007FFD5C8A5000-memory.dmp

    Filesize

    2.0MB