Analysis
-
max time kernel
101s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-09-2024 08:57
General
-
Target
ccae6dda8f6f5637da407188751ef9265975ab9df9f5c0d423785637bfd75bf7.xlam
-
Size
707KB
-
MD5
ee98a1d52ed736d82191c974a7a66694
-
SHA1
e52a106550e320656166ee1a0a1b3d01e6f7e9a3
-
SHA256
ccae6dda8f6f5637da407188751ef9265975ab9df9f5c0d423785637bfd75bf7
-
SHA512
19153bf69604a9f5127fbe6fe4f4230b9d4fd99df0169cbcb6521e227432f046f9355b2b80a3de05383658afa2b8edf2099e70e83894449b1429b6eda3818bb2
-
SSDEEP
12288:VjzcZCWMQ+EeXzhbVDKRiVXJcSjqfV6BPQxtlZA00Cp4LTohRHaQ16O33gXqgxTI:VjoSRzhhDKAVmgaNOLTIHG83roWyY0yL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ccae6dda8f6f5637da407188751ef9265975ab9df9f5c0d423785637bfd75bf7.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5e7dbc470507ab94571a121999c6fba24
SHA1c435942c52c78d690155bf51901ae665948af1ce
SHA2566d45b15ab811ad980135afdb1ec674ab8f40b179f679795fa873766df73b2ea8
SHA5125703bfd550d52a3b3adb437c7fcb3292702ce380803d68691fba40eed018fed244011852acbc08bc9f09896414fc835920f851b5c5894ac8c3798f6fc7a4f7fa
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB