Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-08-2024 17:49

General

  • Target

    29f90a4f6266e43e668b41187ef4e8c2acdfccab8a8c898e64349a5432081ce6.xls

  • Size

    311KB

  • MD5

    4ece96fcc5af372091e1f928a6492a1c

  • SHA1

    d04331288712b3e255072da9cd1654d15d7f05c7

  • SHA256

    29f90a4f6266e43e668b41187ef4e8c2acdfccab8a8c898e64349a5432081ce6

  • SHA512

    d32d6ae4ee8ebbf0effea0563a2d276de33609404e1557d95fd75dce16460b11355cd7b9ec5b62b712ec5f205e358cf66fdc3c9aa1f124880f99637daeba71cc

  • SSDEEP

    6144:/j9MGSIdefkPcoQUlKDfqGVl07J77G1hHzzQOCos0004OMUM:/j9MGSIdefkPjlKDSmlW6vTzDW04e

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\29f90a4f6266e43e668b41187ef4e8c2acdfccab8a8c898e64349a5432081ce6.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4608-1-0x00007FF86F0A5000-0x00007FF86F0A6000-memory.dmp

    Filesize

    4KB

  • memory/4608-0-0x00007FF82F090000-0x00007FF82F0A0000-memory.dmp

    Filesize

    64KB

  • memory/4608-2-0x00007FF82F090000-0x00007FF82F0A0000-memory.dmp

    Filesize

    64KB

  • memory/4608-3-0x00007FF82F090000-0x00007FF82F0A0000-memory.dmp

    Filesize

    64KB

  • memory/4608-4-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-5-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-6-0x00007FF82F090000-0x00007FF82F0A0000-memory.dmp

    Filesize

    64KB

  • memory/4608-9-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-10-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-11-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-12-0x00007FF82BC20000-0x00007FF82BC30000-memory.dmp

    Filesize

    64KB

  • memory/4608-14-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-16-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-15-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-18-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-17-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-13-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-21-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-20-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-19-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-23-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-24-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-26-0x00007FF82BC20000-0x00007FF82BC30000-memory.dmp

    Filesize

    64KB

  • memory/4608-25-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-22-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-27-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-246-0x000001BDC6850000-0x000001BDC6CE0000-memory.dmp

    Filesize

    4.6MB

  • memory/4608-252-0x000001BDC6850000-0x000001BDC6CE0000-memory.dmp

    Filesize

    4.6MB

  • memory/4608-253-0x00007FF86F000000-0x00007FF86F1DB000-memory.dmp

    Filesize

    1.9MB

  • memory/4608-254-0x00007FF86F0A5000-0x00007FF86F0A6000-memory.dmp

    Filesize

    4KB