Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-09-2024 05:12
General
-
Target
0530d54b2b5991438af0651976bec3a26660b2df5f6e21669700f48c9e810df8.xlam
-
Size
665KB
-
MD5
f290c0ba11cf19dd6f4950c9a5668c45
-
SHA1
0c9889f0c02c53ecf67588d279d02ad948cf0d93
-
SHA256
0530d54b2b5991438af0651976bec3a26660b2df5f6e21669700f48c9e810df8
-
SHA512
03c1d493f0ccb6ad009fd2da765267f0754dd0e176147d65f5d0761e0f40f4843bdd764bdafee0519795f792a1e3866f85d73836b35424a531c174e53b6d38c9
-
SSDEEP
12288:/aZJiMBVwRQDPIPz4hLlHSEl7ebLNSB38vzJJkubHOVEgJUSO:SrXjLxEbLNE387JJbHmEgi5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0530d54b2b5991438af0651976bec3a26660b2df5f6e21669700f48c9e810df8.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53e169b518dd3f521308668e6380a82a9
SHA1e0adb6c5c23e9a673000f645c29c0d6938ef5e1b
SHA256d5a4d4d6dfa92a28ca2585a43942e16d72881e4670cdd5b1996457c450b21f68
SHA512bcee94a36caa4aaf07bafda22848f9e3c6f73cab52a3d8123d6791f2bbfdfc3a0756b912c325472e83fa7371ce0aee9d6a7773510a60068c04653fce06bd4746
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB