Analysis

  • max time kernel
    47s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2024 21:52

General

  • Target

    d391c43cf92e851dedad1c7f7ff2df861b58702015aa8118ed35bf901f00e16a.xlsm

  • Size

    92KB

  • MD5

    2eae62461752d8cfd8b0fb1d324c11e4

  • SHA1

    2ac7396abc0baff861020f045c390e657c49689a

  • SHA256

    d391c43cf92e851dedad1c7f7ff2df861b58702015aa8118ed35bf901f00e16a

  • SHA512

    b94d0c3922413fa90f61250bbde9d58726298a03801c8d045f0ddae666a4b7404f6d1fd797c4f23e04dd67cadf54ee2192c184b429345795a7255cd2a02b04d6

  • SSDEEP

    1536:CguZCa6S5khUIisLV6UJl9WXDYVOI4znOSjhLqxMUH9Ga/M1NIpPkUlB7583fjn+:CgugapkhlL6+9WXDYVDaPjpqxvD/Ms8Q

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d391c43cf92e851dedad1c7f7ff2df861b58702015aa8118ed35bf901f00e16a.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    2KB

    MD5

    70d8fb78a2e65fda0c1642ee18623131

    SHA1

    0eba7065dcbd9fd4aa5af7d8d45ecf45dd2bc742

    SHA256

    ce135664ecc165904b5cc66544a0fb9495fc5a46f072803a4adf900ec494d978

    SHA512

    3eb1c46be55bef4d9fa70d932f86dd187a3278d7d736a1a60c12a84d0dbef5c01de3942d86d735ae948754fd8c80a0860886201e49c068c41a88d01b350b25ff

  • memory/2024-15-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-1-0x00007FFA59A2D000-0x00007FFA59A2E000-memory.dmp

    Filesize

    4KB

  • memory/2024-6-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-4-0x00007FFA19A10000-0x00007FFA19A20000-memory.dmp

    Filesize

    64KB

  • memory/2024-5-0x00007FFA19A10000-0x00007FFA19A20000-memory.dmp

    Filesize

    64KB

  • memory/2024-7-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-9-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-10-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-8-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-14-0x00007FFA17600000-0x00007FFA17610000-memory.dmp

    Filesize

    64KB

  • memory/2024-2-0x00007FFA19A10000-0x00007FFA19A20000-memory.dmp

    Filesize

    64KB

  • memory/2024-3-0x00007FFA19A10000-0x00007FFA19A20000-memory.dmp

    Filesize

    64KB

  • memory/2024-11-0x00007FFA17600000-0x00007FFA17610000-memory.dmp

    Filesize

    64KB

  • memory/2024-16-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-13-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-12-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-72-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-150-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-151-0x00007FFA59A2D000-0x00007FFA59A2E000-memory.dmp

    Filesize

    4KB

  • memory/2024-152-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-153-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-157-0x00007FFA59990000-0x00007FFA59B85000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-0-0x00007FFA19A10000-0x00007FFA19A20000-memory.dmp

    Filesize

    64KB