Analysis
-
max time kernel
23s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 22:01
Behavioral task
behavioral1
Sample
3548daaf3073b7f0384600375500c65dcf6486fd087c0cc5673c03674ef608c3.xls
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3548daaf3073b7f0384600375500c65dcf6486fd087c0cc5673c03674ef608c3.xls
Resource
win10v2004-20240709-en
General
-
Target
3548daaf3073b7f0384600375500c65dcf6486fd087c0cc5673c03674ef608c3.xls
-
Size
135KB
-
MD5
f83779382091eef75723f16ad919cc22
-
SHA1
668f354a50868490fd4abc4f8bdb4fab8bc13c9b
-
SHA256
3548daaf3073b7f0384600375500c65dcf6486fd087c0cc5673c03674ef608c3
-
SHA512
ff53261eea51c95fdd7a7f72aaad798dde076d190bcfaefc639113a96d0f68582546ff847a5bcfec93d45163efa0ef06597bf351d175cd7f1366e9546a7800c0
-
SSDEEP
3072:ZkxAUjZ0ne8yOazERQHLwQp0tm8RShmNIG0tVKYcI:gSe4650t3RShmNIG0tVKY
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2668 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 2668 EXCEL.EXE 2668 EXCEL.EXE 2668 EXCEL.EXE 2668 EXCEL.EXE 2668 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\3548daaf3073b7f0384600375500c65dcf6486fd087c0cc5673c03674ef608c3.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2668-0-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2668-1-0x000000007255D000-0x0000000072568000-memory.dmpFilesize
44KB
-
memory/2668-2-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-5-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-4-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-3-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-6-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-11-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-28-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-27-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-26-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-25-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-24-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-23-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-22-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-20-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-19-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-18-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-17-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-16-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-15-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-14-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-13-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-12-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-10-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-9-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-8-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-7-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB
-
memory/2668-29-0x000000007255D000-0x0000000072568000-memory.dmpFilesize
44KB
-
memory/2668-30-0x0000000000330000-0x0000000000430000-memory.dmpFilesize
1024KB