Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02-09-2024 21:54

General

  • Target

    598d4c63b2257f4df09c50b6a88abee298fc3c729e57d5933c4dbbfea9d31001.xlsm

  • Size

    92KB

  • MD5

    54835ae0fab001f6581ab125a7a4c071

  • SHA1

    3a32dc4df306bbc04bde6940936fadc31cfd5605

  • SHA256

    598d4c63b2257f4df09c50b6a88abee298fc3c729e57d5933c4dbbfea9d31001

  • SHA512

    99f595a201182161313897310ae3f4d922366175b111a587cded172b63b18b184d70f35bc0d2a3410514cb41e4f99fc05942def925bb9b001c5a03dc32a4a15c

  • SSDEEP

    1536:CguZCa6S5khUID/SaWN9c4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIINF3:CgugapkhlD/SpqaPjpM+d/Ms8ULavLcG

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\598d4c63b2257f4df09c50b6a88abee298fc3c729e57d5933c4dbbfea9d31001.xlsm
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2368-1-0x00000000722ED000-0x00000000722F8000-memory.dmp

    Filesize

    44KB

  • memory/2368-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2368-26-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-29-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-27-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-35-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-34-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-32-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-33-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-39-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-38-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-37-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-36-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-31-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-30-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-46-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-48-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-47-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-45-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-44-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-43-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-42-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-51-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-65-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-64-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-63-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-62-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-61-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-60-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-59-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-58-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-57-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-56-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-55-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-54-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-53-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-52-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-50-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-49-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-41-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-40-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-66-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-67-0x00000000722ED000-0x00000000722F8000-memory.dmp

    Filesize

    44KB

  • memory/2368-68-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-69-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-70-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-71-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB

  • memory/2368-72-0x0000000006850000-0x0000000006950000-memory.dmp

    Filesize

    1024KB