Analysis

  • max time kernel
    58s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 21:32

General

  • Target

    a90d15d601ec2a432459fc12547ef4ffbf53dc8f8c731e9524cdabdac57c72a0.xlsm

  • Size

    92KB

  • MD5

    2ff70da8368f1eda2e45d235e40ed1f0

  • SHA1

    c719f31e4c6af8f1c36407704d0422282414578d

  • SHA256

    a90d15d601ec2a432459fc12547ef4ffbf53dc8f8c731e9524cdabdac57c72a0

  • SHA512

    75c69f6771aa1a48a8542bb51b99e4ec3fca212203f70cae1701053d2b23e3098599e5d63c154d2c46d407c6de433bc130f38a8bc37626a42e231894cc2b7c93

  • SSDEEP

    1536:CguZCa6S5khUIPHaJGBzvFnBG4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYII8uU:CgugapkhlPJBrFnUaPjpM+d/Ms8ULave

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a90d15d601ec2a432459fc12547ef4ffbf53dc8f8c731e9524cdabdac57c72a0.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3196-4-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

    Filesize

    64KB

  • memory/3196-3-0x00007FFD59FED000-0x00007FFD59FEE000-memory.dmp

    Filesize

    4KB

  • memory/3196-2-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

    Filesize

    64KB

  • memory/3196-1-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

    Filesize

    64KB

  • memory/3196-0-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

    Filesize

    64KB

  • memory/3196-5-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-6-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-7-0x00007FFD19FD0000-0x00007FFD19FE0000-memory.dmp

    Filesize

    64KB

  • memory/3196-11-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-12-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-10-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-13-0x00007FFD17670000-0x00007FFD17680000-memory.dmp

    Filesize

    64KB

  • memory/3196-9-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-8-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-14-0x00007FFD17670000-0x00007FFD17680000-memory.dmp

    Filesize

    64KB

  • memory/3196-16-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-15-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-62-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-150-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB

  • memory/3196-151-0x00007FFD59F50000-0x00007FFD5A145000-memory.dmp

    Filesize

    2.0MB