eec026537b176cfd946ead7d3484350d583a42946dcfd7f7cc52ef007a8e329d

Analysis

max time kernel
28s
max time network
19s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eec026537b176cfd946ead7d3484350d583a42946dcfd7f7cc52ef007a8e329d.xlsm
Size

92KB
MD5

f639adfeae90c4c8ee039e81d4b636d9
SHA1

1652dea4bf2a5528406fdd90e5e0c09b6d424375
SHA256

eec026537b176cfd946ead7d3484350d583a42946dcfd7f7cc52ef007a8e329d
SHA512

8d498169d46a21784c5ed99ca7e00c9f7354787dbcae9674340a8d605fe34d4c35e4da4829d6e102fbcf1ffd9de1ddde21bf816cae4afd1484619c84e0a6971a
SSDEEP

1536:CguZCa6S5khUIXs8CI+pU4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIEFm:CgugapkhlXs8CQaPjpM+d/Ms8ULavLcE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2584 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

2584 EXCEL.EXE
2584 EXCEL.EXE
2584 EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
2584	EXCEL.EXE

pid	process
2584	EXCEL.EXE
2584	EXCEL.EXE
2584	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\eec026537b176cfd946ead7d3484350d583a42946dcfd7f7cc52ef007a8e329d.xlsm
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2584-1-0x000000007230D000-0x0000000072318000-memory.dmp

Filesize
44KB

Download
memory/2584-14-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-39-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-40-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-53-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-66-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-67-0x000000007230D000-0x0000000072318000-memory.dmp

Filesize
44KB

Download
memory/2584-68-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-69-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-70-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-71-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download
memory/2584-72-0x0000000006930000-0x0000000006A30000-memory.dmp

Filesize
1024KB

Download