Analysis
-
max time kernel
133s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/10/2024, 09:45
General
-
Target
decrypted.xlsx
-
Size
1.2MB
-
MD5
2b84eac40b5d1804b8912faf94b83ccf
-
SHA1
a332e55ee3b5634245b571a115615dbd5bd6dc65
-
SHA256
e2c41ecad1439afc87642000af8a353fe81aaed7a5e2f49d46cc10bdd076af57
-
SHA512
c2d46f0df0e1ba754ae39cfc8d8ec76f0112b6bbb06feddc16c8ba5d3cda386b19e07c4fcb045626da9392824da651058c4fc615f92f99ab0903c3884c1999b5
-
SSDEEP
24576:jBeNbAGiGiHz6FhGEP+uqzVfOU0hgPx2rBtM9JsEFunb+O:1IbLiGWE2uuVGUogPx2FtyfYnV
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\decrypted.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5903177be369b9bd57bebe41d76df8d92
SHA1cb81f1986bd74f1da8a6096f0947970ace7787b8
SHA256fd7923da5f591b96073a5960c3efaf9c7b4250be67deabb04bdc7bd1356cc18b
SHA512d2a51937dad857e3653bb493745837b49d7fd98ca5db0126131383331f763abc641bd0d73315eee361927a3adcbbfc69c74d0be3b1405c4f22b73fd43de6f9be
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB