7a7df6217a8b166a1236dec5c71ab493123fd93fc01c8af3ed8dad046e956d56

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

通用商品条形码目录.xls
Size

15KB
MD5

a7ea8725112cd0fd44aa0c8ec1171b49
SHA1

756089c9bf9642cee0ea4485c972205077674399
SHA256

c21e20c9f14bd404108c46b00ff73347de676c6f5e6c6bebd4327942fc63a090
SHA512

a334d8d119f7f2d68d502b54e8c82ad3c34afaddd8e4b2fdce999a4fc495f4a6827b6c371a6df9e152713076114045ba64fbaf851420a538b74b0bc2085bd538
SSDEEP

192:2bKp7p7p73p9eEv8R2j43Zg+LzUB5o30qR0D/tpu4JA/b/i:zVVV3fbv8R2PylG1g4OT6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2556	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2556	EXCEL.EXE
2556	EXCEL.EXE
2556	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\通用商品条形码目录.xls
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2556-1-0x0000000071F7D000-0x0000000071F88000-memory.dmp

Filesize
44KB

Download
memory/2556-2-0x0000000071F7D000-0x0000000071F88000-memory.dmp

Filesize
44KB

Download
memory/2556-3-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2556-4-0x0000000071F7D000-0x0000000071F88000-memory.dmp

Filesize
44KB

Download