Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-09-2024 15:48
General
-
Target
Sipariş Onayı QA09032024.xlam
-
Size
707KB
-
MD5
ee98a1d52ed736d82191c974a7a66694
-
SHA1
e52a106550e320656166ee1a0a1b3d01e6f7e9a3
-
SHA256
ccae6dda8f6f5637da407188751ef9265975ab9df9f5c0d423785637bfd75bf7
-
SHA512
19153bf69604a9f5127fbe6fe4f4230b9d4fd99df0169cbcb6521e227432f046f9355b2b80a3de05383658afa2b8edf2099e70e83894449b1429b6eda3818bb2
-
SSDEEP
12288:VjzcZCWMQ+EeXzhbVDKRiVXJcSjqfV6BPQxtlZA00Cp4LTohRHaQ16O33gXqgxTI:VjoSRzhhDKAVmgaNOLTIHG83roWyY0yL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Sipariş Onayı QA09032024.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57af3f670be5b59b9c9795eb06f5a2a42
SHA1eb8d969dd878129aa53213def7e0dcc793c3e2f7
SHA256d415c9205303ce3f116473959093645241f46bdb2a9eaddb09e5bfcb267f141c
SHA512ce05dbd87d9d011862779a02ddfc21c9484997e118754238df2ba7a0af9302b50a0014a2f46839fda199e0fcbc3f54357551d75b37556cab1c832292a5c49364
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB