Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2024, 08:35

General

  • Target

    Templates/Action.xls

  • Size

    18KB

  • MD5

    9e4bb1f32c3deac9ec235548b0299bca

  • SHA1

    4532b9ad26c5407b31c8085725de193521ff6bdf

  • SHA256

    b28aa179eb88cd7b028b9484972da41a64549d6aca3f249228b24c3e94ee8274

  • SHA512

    387fb1521abb24ba931d0403fde46f23c9296f59fe30ad3e926748464957a192f0ef040e6305d8176fa9f477ce42e8a242f118b57ad95bd6f3a29f3ce6bdb8cf

  • SSDEEP

    384:GpBtqCR22ro0QVeGbLjbtK2zzt1LHpsueTl8DqWAQ:GpBtqCR2g2suE8OWAQ

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Templates\Action.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    86be1a142618bbe5ac5418495582e5a6

    SHA1

    e63ac64d29307168a59eb8e83bbbfde1fd2be6b7

    SHA256

    44e5e3ea24bd9a0f42db1985765edc43039cacbde85e723b7bebb6dff8de30dd

    SHA512

    7839d70d893cbde932486a20aa9ea9c4fcf5968dd5db80c3aed36235bf725ca79580389fa77a9c5a2919efde1afc9ac5c5172e96bb9bdb5db1e29d79a39c1ba4

  • memory/1632-9-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-48-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-1-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-4-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-5-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-7-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-0-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-10-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-8-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-6-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-11-0x00007FFA4FED0000-0x00007FFA4FEE0000-memory.dmp

    Filesize

    64KB

  • memory/1632-20-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-3-0x00007FFA9268D000-0x00007FFA9268E000-memory.dmp

    Filesize

    4KB

  • memory/1632-13-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-12-0x00007FFA4FED0000-0x00007FFA4FEE0000-memory.dmp

    Filesize

    64KB

  • memory/1632-19-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-18-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-17-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-16-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-14-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-2-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-31-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-45-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-46-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-15-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1632-47-0x00007FFA52670000-0x00007FFA52680000-memory.dmp

    Filesize

    64KB

  • memory/1632-49-0x00007FFA925F0000-0x00007FFA927E5000-memory.dmp

    Filesize

    2.0MB