Analysis

  • max time kernel
    46s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-09-2024 21:02

General

  • Target

    b17678c9d22eaecef3a090ddc977851794d980b0d1f1692fcee1495ebef835fe.xlsm

  • Size

    92KB

  • MD5

    329833137d90521302de60e5a258650d

  • SHA1

    2e499f41aa95656d841329b82ab7a92341a60103

  • SHA256

    b17678c9d22eaecef3a090ddc977851794d980b0d1f1692fcee1495ebef835fe

  • SHA512

    3fb55a28b4924081cc84bd7fd25eea881c22cfa2f5d980d4e8bebb8f4f4cb314bb0d03ab11e1f13639d8dd4f4318d732bc5accd0932cdc0e4ef230a806cb103a

  • SSDEEP

    1536:CguZCa6S5khUIR2IzEN4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIbFq:CgugapkhlR2taPjpM+d/Ms8ULavLcb

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b17678c9d22eaecef3a090ddc977851794d980b0d1f1692fcee1495ebef835fe.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    2c4ab997db0293c9b794be2b15267575

    SHA1

    3d320c650ac2127a279b354122e73b529af61992

    SHA256

    3cb88857131406ab9bb062f9becf373e2b9c7b5584759ebea6af29f28a7e0991

    SHA512

    b1c4b41aa7414c9e05124a95074df63424eb93dcc1ee00cef443271999525299f853375a5414fb252b4f4fb5018b7941d18c67c1210d6c5bae4b6be88b3a6fb7

  • memory/1444-7-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-148-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-3-0x00007FFAE3B50000-0x00007FFAE3B60000-memory.dmp

    Filesize

    64KB

  • memory/1444-4-0x00007FFAE3B50000-0x00007FFAE3B60000-memory.dmp

    Filesize

    64KB

  • memory/1444-5-0x00007FFAE3B50000-0x00007FFAE3B60000-memory.dmp

    Filesize

    64KB

  • memory/1444-10-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-9-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-12-0x00007FFAE1AF0000-0x00007FFAE1B00000-memory.dmp

    Filesize

    64KB

  • memory/1444-0-0x00007FFAE3B50000-0x00007FFAE3B60000-memory.dmp

    Filesize

    64KB

  • memory/1444-2-0x00007FFAE3B50000-0x00007FFAE3B60000-memory.dmp

    Filesize

    64KB

  • memory/1444-8-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-6-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-13-0x00007FFAE1AF0000-0x00007FFAE1B00000-memory.dmp

    Filesize

    64KB

  • memory/1444-59-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-145-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-146-0x00007FFB23B6D000-0x00007FFB23B6E000-memory.dmp

    Filesize

    4KB

  • memory/1444-147-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-1-0x00007FFB23B6D000-0x00007FFB23B6E000-memory.dmp

    Filesize

    4KB

  • memory/1444-152-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1444-11-0x00007FFB23AD0000-0x00007FFB23CC5000-memory.dmp

    Filesize

    2.0MB