Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 06:35
Behavioral task
behavioral1
Sample
MF_99461001_PERIODEND_P10_21.07.2024.xls
Resource
win7-20240705-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
MF_99461001_PERIODEND_P10_21.07.2024.xls
Resource
win10v2004-20240709-en
6 signatures
150 seconds
General
-
Target
MF_99461001_PERIODEND_P10_21.07.2024.xls
-
Size
1.3MB
-
MD5
6a5b15d9e6bb033e46489be8cdd09849
-
SHA1
c67e28a3dc3bd24b3013ed445e961dac2bc40905
-
SHA256
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9
-
SHA512
f3af74171844d7a91de289921b670215b5534c7c7a98e707e2750fbc2c46705811ce121f02fc2bab7b269e208dd1796de385e3aab4a19ec9ebb369843de77e76
-
SSDEEP
24576:TCEyzgdI6eFAj99CB5ml31tD1HlmKQPpsmsyX1JRIwIz1QVEl:TCEwT6eFAj3Cjm3HlUhOa1nRRVA
Score
1/10
Malware Config
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2392 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2392 EXCEL.EXE 2392 EXCEL.EXE 2392 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2392 wrote to memory of 1044 2392 EXCEL.EXE 30 PID 2392 wrote to memory of 1044 2392 EXCEL.EXE 30 PID 2392 wrote to memory of 1044 2392 EXCEL.EXE 30 PID 2392 wrote to memory of 1044 2392 EXCEL.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\MF_99461001_PERIODEND_P10_21.07.2024.xls1⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1044
-