Analysis

  • max time kernel
    58s
  • max time network
    62s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 21:37

General

  • Target

    f9b115ae9e869f5ef8b5339f7662f8de0f1853a701de9b692130c7e5d8c0accc.xlsx

  • Size

    70KB

  • MD5

    f10c0772712cac89a71b863c270e1f87

  • SHA1

    96c8a9b3d428a70af11a41fdd7ae2f7d3c79b0a2

  • SHA256

    f9b115ae9e869f5ef8b5339f7662f8de0f1853a701de9b692130c7e5d8c0accc

  • SHA512

    dd078293a3e38656eacc8cb47cd6c443d804be0e80169012f4873d27264e1584a7d6ef72603530faed37056a1d330873510eba844c8fd3d93cd63c592fb6586a

  • SSDEEP

    1536:+IaLfReW6G8W5K7lVnU9vKSMhCB8IsCsaiYD:+IDWllZhz4Y8hDe

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f9b115ae9e869f5ef8b5339f7662f8de0f1853a701de9b692130c7e5d8c0accc.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/572-1-0x00007FFA4DE8D000-0x00007FFA4DE8E000-memory.dmp

    Filesize

    4KB

  • memory/572-0-0x00007FFA0DE70000-0x00007FFA0DE80000-memory.dmp

    Filesize

    64KB

  • memory/572-3-0x00007FFA0DE70000-0x00007FFA0DE80000-memory.dmp

    Filesize

    64KB

  • memory/572-4-0x00007FFA0DE70000-0x00007FFA0DE80000-memory.dmp

    Filesize

    64KB

  • memory/572-6-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-9-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-8-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-12-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-11-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-13-0x00007FFA0B510000-0x00007FFA0B520000-memory.dmp

    Filesize

    64KB

  • memory/572-10-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-14-0x00007FFA0B510000-0x00007FFA0B520000-memory.dmp

    Filesize

    64KB

  • memory/572-7-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-18-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-19-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-17-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-16-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-15-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-5-0x00007FFA0DE70000-0x00007FFA0DE80000-memory.dmp

    Filesize

    64KB

  • memory/572-2-0x00007FFA0DE70000-0x00007FFA0DE80000-memory.dmp

    Filesize

    64KB

  • memory/572-33-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB

  • memory/572-34-0x00007FFA4DE8D000-0x00007FFA4DE8E000-memory.dmp

    Filesize

    4KB

  • memory/572-35-0x00007FFA4DDF0000-0x00007FFA4DFE5000-memory.dmp

    Filesize

    2.0MB