Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2024, 08:35

General

  • Target

    Templates/bargainE.xls

  • Size

    31KB

  • MD5

    a8ab6c676af23b9d7ffe35833ec8e6cd

  • SHA1

    32158b6e7635470a2092f6fab1f0f94258f73610

  • SHA256

    e397d38eb26184bda752d5cbcf790be6b7eaeb8b2848c613d8b8335d080ced54

  • SHA512

    afc80b92bf74715b737fbe2acaadaf8ace6e44c2fa3f01fdec7f190cea3976c7c338dbfd6e75285009d904672418e4821e144a26e2152c02054de4671507d555

  • SSDEEP

    768:SAYbPR2PFumh4bqNEnGJgjSVsdRIr6dU3WZwzil8/+hY7KtkHmpADy1M0q+xoLaa:SAYbw4bqNEnGJgjSVsdRIr6dU3WZwziO

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Templates\bargainE.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/400-0-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-1-0x00007FF9FF9CD000-0x00007FF9FF9CE000-memory.dmp

    Filesize

    4KB

  • memory/400-4-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-5-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-3-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-7-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-6-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-2-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-9-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-12-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-11-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-10-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-13-0x00007FF9BD1E0000-0x00007FF9BD1F0000-memory.dmp

    Filesize

    64KB

  • memory/400-8-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-14-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-15-0x00007FF9BD1E0000-0x00007FF9BD1F0000-memory.dmp

    Filesize

    64KB

  • memory/400-17-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-16-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-25-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB

  • memory/400-26-0x00007FF9FF9CD000-0x00007FF9FF9CE000-memory.dmp

    Filesize

    4KB

  • memory/400-39-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-40-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-42-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-41-0x00007FF9BF9B0000-0x00007FF9BF9C0000-memory.dmp

    Filesize

    64KB

  • memory/400-43-0x00007FF9FF930000-0x00007FF9FFB25000-memory.dmp

    Filesize

    2.0MB