Analysis

  • max time kernel
    46s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 21:16

General

  • Target

    9c590dfe3009e71cf489495ab3ce03d59865bdb6df22a9f77e89f5a7b3d039d6.xlsx

  • Size

    45KB

  • MD5

    c6c269c0f800fcfd0ea720f002c63044

  • SHA1

    b518e9b23de0d3c978eed923c61bc310699d9e37

  • SHA256

    9c590dfe3009e71cf489495ab3ce03d59865bdb6df22a9f77e89f5a7b3d039d6

  • SHA512

    146a5b214a3722044b03d7d1f0977f0fa944e4ecaebc3685f9aaf332a2d39eb5ff23cf9763017c6fbbd02f580813758591a786a429a7ebe74dd1c2d4412925fc

  • SSDEEP

    768:eCSrvTpFBB6UqffqSYHgckhNhsJ8j5aaDIS29mCubd93Am5KsZ/:rSbTsnZYAckhNv9aacLwHQm5KsZ/

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9c590dfe3009e71cf489495ab3ce03d59865bdb6df22a9f77e89f5a7b3d039d6.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4756-0-0x00007FFDA3D4D000-0x00007FFDA3D4E000-memory.dmp

    Filesize

    4KB

  • memory/4756-1-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/4756-3-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/4756-4-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/4756-2-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/4756-9-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-10-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-11-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-12-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-13-0x00007FFD61660000-0x00007FFD61670000-memory.dmp

    Filesize

    64KB

  • memory/4756-8-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-14-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-15-0x00007FFD61660000-0x00007FFD61670000-memory.dmp

    Filesize

    64KB

  • memory/4756-16-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-7-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-6-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-5-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/4756-19-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-21-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-22-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-20-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-18-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-17-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-34-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-35-0x00007FFDA3D4D000-0x00007FFDA3D4E000-memory.dmp

    Filesize

    4KB

  • memory/4756-36-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/4756-37-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB