Analysis

  • max time kernel
    46s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2024 21:18

General

  • Target

    2395fa1369a85aab2e3d6339f37d34b8e1268c3eb9fe5acf20553c7c623f28c7.xls

  • Size

    43KB

  • MD5

    777bd56c7e4dfb07c425d98aca1cd614

  • SHA1

    22e2bd114953addac2d26333de101bdd8a671f45

  • SHA256

    2395fa1369a85aab2e3d6339f37d34b8e1268c3eb9fe5acf20553c7c623f28c7

  • SHA512

    757990d71ac4fa307dbdb4ea4b1d17dfee6740dda3ef9c2207838f76a74837204efb74ff78cdc7c26285e9f939dd5294290c1894d3f2502ef726c3d9f838cf2a

  • SSDEEP

    768:HfT/c8rmjPOtyoVjDGL61EfDlaGGx+c4tUgMYAeHl1A3TAf:r08rmjPOtyoVjDGL61EfDlaGGx+c4tUK

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2395fa1369a85aab2e3d6339f37d34b8e1268c3eb9fe5acf20553c7c623f28c7.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3752-0-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

    Filesize

    64KB

  • memory/3752-1-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

    Filesize

    64KB

  • memory/3752-2-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

    Filesize

    64KB

  • memory/3752-3-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

    Filesize

    64KB

  • memory/3752-5-0x00007FFF16CED000-0x00007FFF16CEE000-memory.dmp

    Filesize

    4KB

  • memory/3752-4-0x00007FFED6CD0000-0x00007FFED6CE0000-memory.dmp

    Filesize

    64KB

  • memory/3752-6-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-7-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-9-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-8-0x00007FFED4BE0000-0x00007FFED4BF0000-memory.dmp

    Filesize

    64KB

  • memory/3752-10-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-11-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-13-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-16-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-17-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-15-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-14-0x00007FFED4BE0000-0x00007FFED4BF0000-memory.dmp

    Filesize

    64KB

  • memory/3752-12-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-19-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-27-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-28-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-34-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-35-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB

  • memory/3752-36-0x00007FFF16C50000-0x00007FFF16E45000-memory.dmp

    Filesize

    2.0MB