Overview

overview

1

Static

static

1

statapril2...0.xlsx

windows10-1703-x64

1

Resubmissions

12/08/2024, 11:37 UTC

240812-nrfehstcqg 1

10/04/2024, 11:48 UTC

240410-nyw1vahg2x 10

Analysis

  • max time kernel
    78s
  • max time network
    79s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/08/2024, 11:37 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    statapril2024-7660.xlsx

  • Size

    56KB

  • MD5

    ea31e71d72077ff13d6e8a1078e9d8dc

  • SHA1

    eedbcfaaef25079d16483da44fc579bf3733733f

  • SHA256

    5a7c4b8d40cd4d7c06f11d4226edd65b734f4a24a1158c5926add4993863f09e

  • SHA512

    e27fb2b995ecdd9039759f6812653106d3ca2be19ee192fdba95083f36f2ea2f9d82ac5338c18fa564d4340fe18482e1aef06b6ca3197f51d08447e62de17fa9

  • SSDEEP

    768:ZFnM1dDlT2qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD15ogXnlq5gR:/mZ2u4OPKIxoEuDKJnlnR

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\statapril2024-7660.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4660
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localservice -s fdPHost
    1⤵
      PID:168

    Network

    • flag-us
      DNS
      roaming.officeapps.live.com
      EXCEL.EXE
      Remote address:
      8.8.8.8:53
      Request
      roaming.officeapps.live.com
      IN A
      Response
      roaming.officeapps.live.com
      IN CNAME
      prod.roaming1.live.com.akadns.net
      prod.roaming1.live.com.akadns.net
      IN CNAME
      eur.roaming1.live.com.akadns.net
      eur.roaming1.live.com.akadns.net
      IN CNAME
      frc-azsc-000.roaming.officeapps.live.com
      frc-azsc-000.roaming.officeapps.live.com
      IN CNAME
      osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com
      osiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.com
      IN A
      52.109.68.129
    • flag-fr
      POST
      https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
      EXCEL.EXE
      Remote address:
      52.109.68.129:443
      Request
      POST /rs/RoamingSoapService.svc HTTP/1.1
      Cache-Control: no-cache
      Connection: Keep-Alive
      Pragma: no-cache
      Content-Type: text/xml; charset=utf-8
      User-Agent: MS-WebServices/1.0
      SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
      Content-Length: 511
      Host: roaming.officeapps.live.com
      Response
      HTTP/1.1 200 OK
      Cache-Control: private
      Content-Type: text/xml; charset=utf-8
      Server: Microsoft-IIS/10.0
      X-OfficeFE: RoamingFE_IN_49
      X-OfficeVersion: 16.0.18004.30575
      X-OfficeCluster: frc-000.roaming.officeapps.live.com
      X-CorrelationId: 8894cc8c-d361-4d73-afeb-d29c88a272b7
      X-Powered-By: ASP.NET
      Date: Mon, 12 Aug 2024 11:37:47 GMT
      Content-Length: 654
    • flag-us
      DNS
      46.28.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      46.28.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      129.68.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      129.68.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      73.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.173.189.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      c.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
      Remote address:
      8.8.8.8:53
      Request
      c.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 52.109.68.129:443
      https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
      tls, http
      EXCEL.EXE
      1.7kB
       7.7kB
       11
      10

      HTTP Request

      POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svc

      HTTP Response

      200
    • 45.89.53.187:445
      156 B
       3
    • 45.89.53.187:139
      156 B
       3
    • 45.89.53.187:445
      156 B
       3
    • 45.89.53.187:139
      156 B
       3
    • 8.8.8.8:53
      roaming.officeapps.live.com
      dns
      EXCEL.EXE
      73 B
       250 B
       1
      1

      DNS Request

      roaming.officeapps.live.com

      DNS Response

      52.109.68.129

    • 8.8.8.8:53
      46.28.109.52.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      46.28.109.52.in-addr.arpa

    • 8.8.8.8:53
      129.68.109.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      129.68.109.52.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      73.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      73.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      15.173.189.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      15.173.189.20.in-addr.arpa

    • 239.255.255.250:3702
      fdPHost
      2.6kB
       4
    • 239.255.255.250:3702
      fdPHost
    • 8.8.8.8:53
      c.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
      dns
      118 B
       182 B
       1
      1

      DNS Request

      c.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4660-0-0x00007FF90E040000-0x00007FF90E050000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4660-2-0x00007FF90E040000-0x00007FF90E050000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4660-1-0x00007FF90E040000-0x00007FF90E050000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4660-3-0x00007FF90E040000-0x00007FF90E050000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4660-8-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-7-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-10-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-9-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-4-0x00007FF94E055000-0x00007FF94E056000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4660-11-0x00007FF90AF80000-0x00007FF90AF90000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4660-12-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-13-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-14-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-15-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-17-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-16-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-20-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-21-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-19-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-18-0x00007FF90AF80000-0x00007FF90AF90000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4660-22-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-24-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-23-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-27-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-29-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-26-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-25-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-28-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4660-186-0x00007FF94DFB0000-0x00007FF94E18B000-memory.dmp

      Filesize

      1.9MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.