Analysis

  • max time kernel
    46s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:19

General

  • Target

    a372be1263f8c94749dd40776238dac09f3d5b74d2485d7c4ae4d6745801f14b.xlsm

  • Size

    92KB

  • MD5

    241a61fc751164bc4d01fc471f39c473

  • SHA1

    a3984d943520048251225ab2410885cdcad53e96

  • SHA256

    a372be1263f8c94749dd40776238dac09f3d5b74d2485d7c4ae4d6745801f14b

  • SHA512

    88f261a4b97505510a8e74151388fd10fb8db7b4339597bc996f1c31f0823e28b8335d925b90bb22bc4413aced472be13d491e5163168c31cf8ccde888bec9c7

  • SSDEEP

    1536:CguZCa6S5khUIMmwiisU9is4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIILuOFd:CgugapkhlM1iiZ9isaPjpM+d/Ms8ULaN

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a372be1263f8c94749dd40776238dac09f3d5b74d2485d7c4ae4d6745801f14b.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    d806869ac71c58013b93d13df9ad3bc8

    SHA1

    da5c1eb8744b0b21eab373cf3e1726499951b6d7

    SHA256

    13d9d97bf5cc13b6c1d24351efb450c4ccb735c50451c07c0147f31ed553a753

    SHA512

    23c962b8777fcf71718eceac35f9f4b4d88973936b56055bc941208829a6b6d991703cb48af0d93725e164919b656537f6523f44745783521559d91b8f1926ad

  • memory/4404-8-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-5-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-3-0x00007FFC5E270000-0x00007FFC5E280000-memory.dmp

    Filesize

    64KB

  • memory/4404-6-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-7-0x00007FFC5E270000-0x00007FFC5E280000-memory.dmp

    Filesize

    64KB

  • memory/4404-11-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-10-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-9-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-12-0x00007FFC5B910000-0x00007FFC5B920000-memory.dmp

    Filesize

    64KB

  • memory/4404-0-0x00007FFC5E270000-0x00007FFC5E280000-memory.dmp

    Filesize

    64KB

  • memory/4404-2-0x00007FFC5E270000-0x00007FFC5E280000-memory.dmp

    Filesize

    64KB

  • memory/4404-14-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-13-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-15-0x00007FFC5B910000-0x00007FFC5B920000-memory.dmp

    Filesize

    64KB

  • memory/4404-4-0x00007FFC5E270000-0x00007FFC5E280000-memory.dmp

    Filesize

    64KB

  • memory/4404-73-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-149-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-150-0x00007FFC9E28D000-0x00007FFC9E28E000-memory.dmp

    Filesize

    4KB

  • memory/4404-151-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-155-0x00007FFC9E1F0000-0x00007FFC9E3E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4404-1-0x00007FFC9E28D000-0x00007FFC9E28E000-memory.dmp

    Filesize

    4KB