Analysis
-
max time kernel
137s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-10-2024 01:11
General
-
Target
2dad4b0d2557af1cadd3c7cb8e06f37c767c6565d2ec598a116a3063b92b0420.xlam
-
Size
596KB
-
MD5
6073b84bbdc3b910df55b8b42a16ab65
-
SHA1
28c95e7d8f2fa7dee552bcc190b7ec6aaa9ea9f3
-
SHA256
2dad4b0d2557af1cadd3c7cb8e06f37c767c6565d2ec598a116a3063b92b0420
-
SHA512
1392956610ded25dc8e5ca50c5a15218e3a2ecdc12314ae7bf0313a47dd35c2ead7aba74fc7381542c2e107b547bbef23f9be1ea8ff653b3da1e1f951485a50d
-
SSDEEP
12288:JJRTchjxyfDF5NYzNewgU8mLQobusNRO+IXbpwOjMbR6I6EfjOvCxicvG:JJp4j2FYReBm9bpNROtgt6zErkC7vG
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2dad4b0d2557af1cadd3c7cb8e06f37c767c6565d2ec598a116a3063b92b0420.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
679B
MD5fa744d9cf2a3e8c50080f5670957f382
SHA15e06e51bd90b9753390196b175d2321232f75c19
SHA256f4c398d6961be3ce624c728cf0477b1210d0a41359f7c534144314df25cfd298
SHA512dfbedd0bf5bad22ab8d0e18b684f07b8a8ea95fe42843d1a24898e788792554d7cd152fc8a390555ff8f6d77b838df3045ea68059d42d5c1206e7d3379cde9d6
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB