Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
29/08/2024, 05:58
General
-
Target
Order items.xlam
-
Size
592KB
-
MD5
998d519ffcf2b532b54bc0af06ca09e5
-
SHA1
09b8c2ca04074258d7e0dfcdae3de69ac14839e0
-
SHA256
8ac0387b8e277a1215cdcfda4117629edefc7b987c8e8f76ad9e81519a19946d
-
SHA512
585edbe518e596ad2117f31b740a2e5b71b1e5ea0b09dab42b50fa8a95ee1affe750fe06f5b557830c1750b45d5424c0f41dbeffcef4b52f69134a96d51aeb38
-
SSDEEP
12288:9yq/HEGwdV67N6SL7fNoAT2oht19dzV+teNQQoJYAMB:QqAdk7nL7v19dZ+y8JYAMB
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Order items.xlam"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Launches Equation Editor
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB