Analysis

  • max time kernel
    41s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03-07-2024 21:02

General

  • Target

    729c2c41e2160ea0f9c3ffd5918db0e046aa9c978844500b8c9c52b0265b9ac9.xls

  • Size

    73KB

  • MD5

    fb18041ce63792de83fab651e83f4ac6

  • SHA1

    4637967212651a20033bd6225879e9e430c8aec2

  • SHA256

    729c2c41e2160ea0f9c3ffd5918db0e046aa9c978844500b8c9c52b0265b9ac9

  • SHA512

    574663005951a836388c7af25f496a78e5f6adc3677fe4deeafd54736e18531f44ae80e739e1bfd62b95d8c4d0bffb661c9eac094704d85dfad8176b729365eb

  • SSDEEP

    384:TcDV9ZTGheA+riggyZsIXCfUTC4sDvC6jsBBCMfcKSCHkMmbVogsL1nq4UuhZa+W:wD5HrigFN5I0K+4sL7h7Yaza86

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\729c2c41e2160ea0f9c3ffd5918db0e046aa9c978844500b8c9c52b0265b9ac9.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2872-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2872-1-0x000000007280D000-0x0000000072818000-memory.dmp

    Filesize

    44KB

  • memory/2872-3-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2872-4-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2872-2-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2872-5-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2872-6-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

  • memory/2872-9-0x000000007280D000-0x0000000072818000-memory.dmp

    Filesize

    44KB

  • memory/2872-10-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB