Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/10/2024, 07:40
General
-
Target
PI-90349003421.xlsx
-
Size
1.5MB
-
MD5
9a809e0f1d435948eacdf1f0fb8b8316
-
SHA1
aea62b0466c64967303de73085f16f40018cd44e
-
SHA256
d52b8e527ad35f54de8e65b0d7c324a9c1afddcd0d09e4d20ea0cb7c8b327394
-
SHA512
15630f6cf033f1c1fd43044c96ffe5b36593c56c9abc6d4b77d3c70b76c5ba73a1ecba679986b7e102c18b521067fc351e519102b8e74f4354babff0aac31697
-
SSDEEP
24576:uVuRVKY8KpiARLlSRqqCfboz6Ga73J1Tkiv9jnQIesN7Vsj5j8m4beb9I:DRYipb0Rq5f06G8PVv9jnMsNOVomFW
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PI-90349003421.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51c51454ff1470304d590800b793aa3a1
SHA18f1b68b0a0b92bdfc972a6ca5a5979be96a41685
SHA25610175bb0a964672efdd1ac7af11042f1e002ef428f206d466fb14d5ad635ee22
SHA512c62abc9f69e8624acd564c8a76bd683d8f2e9f00ff7775da7ebae059616a6e07dd31b0483634461af4a4662245b4199a876fd182d5e40fae94a90cfa2bf22ae3
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB