Analysis

  • max time kernel
    133s
  • max time network
    129s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-10-2024 09:46

General

  • Target

    malware.xlsx

  • Size

    2.2MB

  • MD5

    af4a015e14731aca9d5d89d18b6145a5

  • SHA1

    d43b9773c95cf3c7b0db3bf7d7571ea57db88898

  • SHA256

    d54bdc32e63a1159d8775046e4ac77bd96a6745c29049effea5303a37e2d865a

  • SHA512

    9629b2bffe3761bb7a9c5a31dc229f46f42a111825eb1c17a880228ae76a9ebd708e9c274661211dc82c436cf0de8ff0b6f1da45960e9f21c29a8e70ce24c774

  • SSDEEP

    49152:Jp1keRzwrg87vtJer92x2zUkW2AhynUOAgLhouLDDeccF51Q:Jsm387XdkSPkNfJ

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\malware.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    b7d45043b9ae20a2e2a85497ce4ebf44

    SHA1

    7387414966a5cc10f4da90f748e603185cd90262

    SHA256

    14862b3f634d43a012fe121c75cdd5e115883a0884424e40186fd3bce6042f76

    SHA512

    e307bbabfde7f6a64f154b51cb5c336936e90d0db7a3a045a2b5fadd61e556429c75fbace183abc44276ebc3769e23f3168766d5df10e6093f9947a651441165

  • memory/4636-13-0x00007FFC16950000-0x00007FFC16960000-memory.dmp

    Filesize

    64KB

  • memory/4636-26-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-1-0x00007FFC194F0000-0x00007FFC19500000-memory.dmp

    Filesize

    64KB

  • memory/4636-4-0x00007FFC194F0000-0x00007FFC19500000-memory.dmp

    Filesize

    64KB

  • memory/4636-3-0x00007FFC59503000-0x00007FFC59504000-memory.dmp

    Filesize

    4KB

  • memory/4636-0-0x00007FFC194F0000-0x00007FFC19500000-memory.dmp

    Filesize

    64KB

  • memory/4636-7-0x00007FFC194F0000-0x00007FFC19500000-memory.dmp

    Filesize

    64KB

  • memory/4636-8-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-10-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-11-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-5-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-6-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-9-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-15-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-14-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-16-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-18-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-17-0x00007FFC16950000-0x00007FFC16960000-memory.dmp

    Filesize

    64KB

  • memory/4636-19-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-20-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-25-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-2-0x00007FFC194F0000-0x00007FFC19500000-memory.dmp

    Filesize

    64KB

  • memory/4636-30-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB

  • memory/4636-12-0x00007FFC59460000-0x00007FFC59669000-memory.dmp

    Filesize

    2.0MB