Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 21:23
Static task
static1
Behavioral task
behavioral1
Sample
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8.xlsx
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8.xlsx
Resource
win10v2004-20240802-en
General
-
Target
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8.xlsx
-
Size
43KB
-
MD5
9e82cba997ed7f3544cd6243e564016e
-
SHA1
5453a4fea0ebb34c1c8bd66ee97aa5a030d00bed
-
SHA256
5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8
-
SHA512
ed8d6a61858d529b1aade2764b0c931392a4ea8616102bbdb86b137689cb7b01c28d69ecb7819c9a8f8a4ac31bb2b308a3aba08590c0c5eacffb9aedd3f3a463
-
SSDEEP
768:7CToywfPCfdc/buIgsqlkVw2WFc8SGnCu2JBgBkXrI34gB2JL0AWoP80h:WToHKsb6yVwpFB1CuEge7tgo0KDh
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 964 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEpid process 964 EXCEL.EXE 964 EXCEL.EXE 964 EXCEL.EXE 964 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\5096e66771b2d0a991afdf83cb73463a884faa81942f986aa1a38d342946a9d8.xlsx1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:964