Analysis

  • max time kernel
    47s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 21:10

General

  • Target

    2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls

  • Size

    126KB

  • MD5

    d89dfeaadf6cdf2b7ea3435644180b3a

  • SHA1

    bc9767d6217daba21cfdf8ed7e8dba01742bf196

  • SHA256

    2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d

  • SHA512

    928a0d467b79ba834f031e2a220c75e56017f7df7dba57be4a9ce274881f422683d70fdf39053c5f1496d1c59bb084fe6e8c0984d70b7740be49a1df631a560e

  • SSDEEP

    1536:KdKcpx2Sk/8E3NEN1vn5jG685uUDf44fAg:8AxdEzvn5jb8cU

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2ae4d463cd4df974d95288744d1bbf686b42db45896e6c0ad4917f7aab42f32d.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    d851f0dbc7e5b69cfd0baadbba85157b

    SHA1

    bc6c039ddfa536318b2df6f1f4e169566fb96035

    SHA256

    b9433b156f97f210bfe887fb447fbc949099b59ad1d2a28e18435aab675c4879

    SHA512

    2d4659e586d2188dcb514cc33a1afe03ec7d8c3cfaf1ddf788541e9f6a4a16c78e67897e9c289e5a7c5cb9e1957fd65ae2a64373e9ee33fdec5f2dda4f9c607d

  • memory/4848-8-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-35-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-13-0x00007FFCC16D0000-0x00007FFCC16E0000-memory.dmp

    Filesize

    64KB

  • memory/4848-0-0x00007FFCC3DD0000-0x00007FFCC3DE0000-memory.dmp

    Filesize

    64KB

  • memory/4848-5-0x00007FFD03DED000-0x00007FFD03DEE000-memory.dmp

    Filesize

    4KB

  • memory/4848-9-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-6-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-11-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-12-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-7-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-4-0x00007FFCC3DD0000-0x00007FFCC3DE0000-memory.dmp

    Filesize

    64KB

  • memory/4848-1-0x00007FFCC3DD0000-0x00007FFCC3DE0000-memory.dmp

    Filesize

    64KB

  • memory/4848-10-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-16-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-18-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-19-0x00007FFCC16D0000-0x00007FFCC16E0000-memory.dmp

    Filesize

    64KB

  • memory/4848-17-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-15-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-14-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-22-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-29-0x00007FFD03D50000-0x00007FFD03F45000-memory.dmp

    Filesize

    2.0MB

  • memory/4848-3-0x00007FFCC3DD0000-0x00007FFCC3DE0000-memory.dmp

    Filesize

    64KB

  • memory/4848-2-0x00007FFCC3DD0000-0x00007FFCC3DE0000-memory.dmp

    Filesize

    64KB