Resubmissions

29/09/2024, 15:11

240929-sk3npaseqc 3

29/09/2024, 15:08

240929-sh684aygkk 3

29/09/2024, 15:07

240929-shbr7ayfqn 7

Analysis

  • max time kernel
    300s
  • max time network
    202s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29/09/2024, 15:08

General

  • Target

    Odin Downloader Release Notes.xlsx

  • Size

    874KB

  • MD5

    e792e1676d7127f5b5453ea8c2364e40

  • SHA1

    ab59798f402ccdcf4a6502251d2bd92a386a17ca

  • SHA256

    eb74fc58600168031c50a26262858afdd5427544d881fb6b45e707ffe9624d51

  • SHA512

    71fdd50adcd178251a708a09c0ba283b508b27feb0494f3355325665e038e35078bf61b5a451a6fab298d0172842b46d0ee5f5b4f3b291ddb166458e5886ec1c

  • SSDEEP

    24576:wO3vdVrGWYV3KFF1i4jhGx6TzUIDrt9oqc3Ssm9+:wGv7rGWY2F1t0xqrt9DCZn

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Odin Downloader Release Notes.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2832

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

          Filesize

          1KB

          MD5

          4844d49ecb4e20d4594aaeb475f296ef

          SHA1

          50c8da266fc6f2ed49e98a6541fc0d6787c7b9db

          SHA256

          09326cfcf99f074a2e0b87c17050aa1be5f03f371ae8b7f1a46b95b47fc3db9c

          SHA512

          a697206e04248ef802b6b7f36ff7d41765ca29fcf2065c7f364c59d3710ad3aff5f80b26df47fc7a1bdfbad54296de744284947d60ce42fb09838636e44744d5

        • memory/2832-11-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-71-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-2-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-4-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-6-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-5-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-10-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-9-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-8-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-7-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-12-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-0-0x00007FFC20A63000-0x00007FFC20A64000-memory.dmp

          Filesize

          4KB

        • memory/2832-3-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-13-0x00007FFBDE260000-0x00007FFBDE270000-memory.dmp

          Filesize

          64KB

        • memory/2832-25-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-16-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-17-0x00007FFBDE260000-0x00007FFBDE270000-memory.dmp

          Filesize

          64KB

        • memory/2832-24-0x00007FFC20A63000-0x00007FFC20A64000-memory.dmp

          Filesize

          4KB

        • memory/2832-15-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-26-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-1-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-68-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-14-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB

        • memory/2832-69-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-70-0x00007FFBE0A50000-0x00007FFBE0A60000-memory.dmp

          Filesize

          64KB

        • memory/2832-72-0x00007FFC209C0000-0x00007FFC20BC9000-memory.dmp

          Filesize

          2.0MB