Analysis

  • max time kernel
    128s
  • max time network
    140s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-07-2024 00:21

General

  • Target

    Battlefield 2/bf2editor/Help/CommandDescriptions.xls

  • Size

    100KB

  • MD5

    cccda810f657c25b2b3be9aaa950195e

  • SHA1

    c60d8f33a0854e586186f77422d80fc84014c82e

  • SHA256

    75df619875de710e75e286f57d445fda8d670a90e2162336c2cbfe545f02772a

  • SHA512

    61d7492c4e35c94ee8bfc9ceac59d9227f0fb93be0976872c4b401f67d9ad869d2803c7c19086fbe627c59999612ea7458639694def094e58baa71478d2029df

  • SSDEEP

    1536:n4vEj3GV9ie7qujSIGcnqIsQ0505Bmzelp+8VFhuzQ+/chIYYE1tZ5J+f8kyrYdY:4vEj3GOezwZzelJuS2

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Battlefield 2\bf2editor\Help\CommandDescriptions.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2580-4-0x00007FF855490000-0x00007FF8554A0000-memory.dmp

    Filesize

    64KB

  • memory/2580-3-0x00007FF855490000-0x00007FF8554A0000-memory.dmp

    Filesize

    64KB

  • memory/2580-9-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-8-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-7-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-2-0x00007FF855490000-0x00007FF8554A0000-memory.dmp

    Filesize

    64KB

  • memory/2580-1-0x00007FF8954A5000-0x00007FF8954A6000-memory.dmp

    Filesize

    4KB

  • memory/2580-0-0x00007FF855490000-0x00007FF8554A0000-memory.dmp

    Filesize

    64KB

  • memory/2580-11-0x00007FF852840000-0x00007FF852850000-memory.dmp

    Filesize

    64KB

  • memory/2580-10-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-12-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-13-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-14-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-15-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-18-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-17-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-16-0x00007FF852840000-0x00007FF852850000-memory.dmp

    Filesize

    64KB

  • memory/2580-20-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-21-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-22-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-23-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-19-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-25-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-27-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-28-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-24-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-26-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-29-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-30-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-31-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-32-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-180-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-181-0x00007FF8954A5000-0x00007FF8954A6000-memory.dmp

    Filesize

    4KB

  • memory/2580-218-0x00007FF855490000-0x00007FF8554A0000-memory.dmp

    Filesize

    64KB

  • memory/2580-221-0x00007FF855490000-0x00007FF8554A0000-memory.dmp

    Filesize

    64KB

  • memory/2580-220-0x00007FF855490000-0x00007FF8554A0000-memory.dmp

    Filesize

    64KB

  • memory/2580-219-0x00007FF855490000-0x00007FF8554A0000-memory.dmp

    Filesize

    64KB

  • memory/2580-222-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB

  • memory/2580-223-0x00007FF895400000-0x00007FF8955DB000-memory.dmp

    Filesize

    1.9MB