Analysis
-
max time kernel
38s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 21:32
Behavioral task
behavioral1
Sample
a90d15d601ec2a432459fc12547ef4ffbf53dc8f8c731e9524cdabdac57c72a0.xlsm
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a90d15d601ec2a432459fc12547ef4ffbf53dc8f8c731e9524cdabdac57c72a0.xlsm
Resource
win10v2004-20240709-en
General
-
Target
a90d15d601ec2a432459fc12547ef4ffbf53dc8f8c731e9524cdabdac57c72a0.xlsm
-
Size
92KB
-
MD5
2ff70da8368f1eda2e45d235e40ed1f0
-
SHA1
c719f31e4c6af8f1c36407704d0422282414578d
-
SHA256
a90d15d601ec2a432459fc12547ef4ffbf53dc8f8c731e9524cdabdac57c72a0
-
SHA512
75c69f6771aa1a48a8542bb51b99e4ec3fca212203f70cae1701053d2b23e3098599e5d63c154d2c46d407c6de433bc130f38a8bc37626a42e231894cc2b7c93
-
SSDEEP
1536:CguZCa6S5khUIPHaJGBzvFnBG4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYII8uU:CgugapkhlPJBrFnUaPjpM+d/Ms8ULave
Malware Config
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2712 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2712 EXCEL.EXE 2712 EXCEL.EXE 2712 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a90d15d601ec2a432459fc12547ef4ffbf53dc8f8c731e9524cdabdac57c72a0.xlsm1⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2712