Resubmissions
22/08/2024, 00:19
240822-amaftayblf 122/08/2024, 00:05
240822-adnxva1hln 122/08/2024, 00:04
240822-acmy6axflh 322/08/2024, 00:02
240822-abtejs1gmj 1Analysis
-
max time kernel
47s -
max time network
20s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
22/08/2024, 00:19
General
-
Target
E20240100021306_Anexo_1.xlsm
-
Size
2.0MB
-
MD5
6e03fd37d1b8ceb1c7172f384849790d
-
SHA1
236bde21ce7cfab3b681646b4d87d9aca8f68024
-
SHA256
48e59c7e61d7826d87086280c02c637377570e24824a77a4ff9df9296ea11ff3
-
SHA512
9385daea011a07f5836a4dbae40aeda56a7b67c31924e551d3a3e1eb6095f3289e8e673caae7e47b468fb5d890711fe498a6df126b1a9635de2f522c8c5e03c8
-
SSDEEP
49152:/HjUhlgth/pBHrl8zP3pV/W9/ugEIJgCFCKyeXCs3:fjUh0FpBB8LZV/W9GAjoDoF3
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\E20240100021306_Anexo_1.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5d12e797f18cb79137ad12b5e5139e1b8
SHA1f15fb437b1be86b714e278ce927b315fa0e16ea3
SHA256afb0f4a0229174f8118ab512b569fdb9eb3ebb0389cb11c9f4a0a2aa88ec258b
SHA512f6e8f99bcd0ecff7683c8e56fa2ffa3fdff16d6c17a2066b36bc3d78e2838130b5b23059a239b29a7ebdd0b5ca36b3f9cf388945bf1aad50a3f91cb8091223cd
-
Filesize
1KB
MD59ac031b4f77582d1d09f41e8ab64d72e
SHA1a6aa53ee37fe8aceaa489482b7a39386b7984e21
SHA256c73307140fa0509de26bb5927e514eea92850758c2dc0c81ac422fde1d29131c
SHA512c695674bd732a8246d1983d56de7b08912c4d7bc782c757e5b0e171d923fbe48fcbb79c2a17cf89c9dffa603141a5ea33085d02f79bd1fd80e12848a8e6de902
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB