Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 02:41
Behavioral task
behavioral1
Sample
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls
Resource
win10v2004-20240709-en
General
-
Target
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls
-
Size
1.3MB
-
MD5
6a5b15d9e6bb033e46489be8cdd09849
-
SHA1
c67e28a3dc3bd24b3013ed445e961dac2bc40905
-
SHA256
a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9
-
SHA512
f3af74171844d7a91de289921b670215b5534c7c7a98e707e2750fbc2c46705811ce121f02fc2bab7b269e208dd1796de385e3aab4a19ec9ebb369843de77e76
-
SSDEEP
24576:TCEyzgdI6eFAj99CB5ml31tD1HlmKQPpsmsyX1JRIwIz1QVEl:TCEwT6eFAj3Cjm3HlUhOa1nRRVA
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2508 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2508 EXCEL.EXE 2508 EXCEL.EXE 2508 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2520 2508 EXCEL.EXE 30 PID 2508 wrote to memory of 2520 2508 EXCEL.EXE 30 PID 2508 wrote to memory of 2520 2508 EXCEL.EXE 30 PID 2508 wrote to memory of 2520 2508 EXCEL.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2520
-