Analysis
-
max time kernel
140s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 19:08
General
-
Target
xlwings-0.31.10-cp38-cp38-win_amd64.zip
-
Size
1.6MB
-
MD5
6bcbcd7db01582157ef54b447c02f5c2
-
SHA1
1edcb95f79687f07fb2f7241a8de738a8b130077
-
SHA256
1a09dc33b327233b2aa4cfddd0379600153e8d2ccb89b70de1336f1bc2c93c49
-
SHA512
a11dca905e327e5de9dd3db7f3b4c11b68e5163a122a2978d4e293408c5ab3d06f0395e0556b58770af324baf65d0f9a8da5da18e76c9906a0b46a89502f348a
-
SSDEEP
49152:NnSBbSGU0rRrCySLz4HydDzKPXOPUYrSsK:EBy0lrBSmyx7PUYjK
Malware Config
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with macros.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\xlwings-0.31.10-cp38-cp38-win_amd64.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\xlwings.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381B
MD5062e8d2c72e6f21266fa9cb092fbdef0
SHA189c8a2cd02480293c0d1d8fa48e4710e4be1b028
SHA256c92e8385eb8bc9385fff1b17e12b35ecb31b29f989df46e71a07e536ad156b8e
SHA5128991838a772ed10e63c65ec6b5d12e58a2264e9891ae408c6ec42faaa9327cb45e38dc24c04d0ce623002c8710e6bac0ecb02f3135b6dd01d10080bc8b342160
-
Filesize
3KB
MD55701b08870edda11ffb212a1be0c4e33
SHA1064428c1ce31e733930b0a28b1e65c5f8dc7c8ee
SHA256b768a8d844bb2a430938083f49f0c57cf645cb27a5613d17f283115af6722e6d
SHA5127c7cab438e73e35379441f3d8e2e6992f05ea6da137e127e425a4105677e2ae0497f2dd165127e77a1fa3e5be7b1033ea2f5375abfc8089b869dedc51d44e9b4
-
Filesize
3KB
MD5bd51bca3236c612396941ebea3360c8c
SHA1344fb4585ed090fd0e2d4f811868726eecffe448
SHA2562aa8e5b90ee38b886a89f058855deb7ad4a7f89c24cf7b4f78f82bb5169c6e43
SHA512e158580baf4d2d211a9b8eccaa0e8098425bb375b75f742019ba9f32452c32b32d7cb9cd173df93b79495451b1678f86ef42cd20f2b6a47e4682ea7fd781a5c9
-
Filesize
241KB
MD5921256fa68924042299a2c7f60068d2f
SHA1f8694ad6db76ed292b1ae193c46c65060aa8ba39
SHA2563423a8a1ef6830efbffbb887e23be0c917b40fd894adc740361346f5d3b3eac8
SHA512afa656a4cd8825e9081f2b446ebf10a3d56922bf7a0f97a8e54e6329a9d2aa3be7a885c36e75d57330728cbc5e1031a0b5bc374a730c337a1d4155fcb6e4fe7c
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB