Analysis

  • max time kernel
    47s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:05

General

  • Target

    4647b50ed71f9e1ab47db0ad95da6c9450e39c74cd2c674fc2543f830ade06bc.xlsm

  • Size

    92KB

  • MD5

    ffa461a7ecfcee1874b7b8e1608bc037

  • SHA1

    8a3271a002a911c5d3e71546e5a095f33581b3c9

  • SHA256

    4647b50ed71f9e1ab47db0ad95da6c9450e39c74cd2c674fc2543f830ade06bc

  • SHA512

    cd9b3bf2fc039aa4332f5f329fa698119406f9554726178e24d9233f6fc77d7c79340f53d0a433150449d9429024911b0eddb915d450c64f79b4dadc14c86b3e

  • SSDEEP

    1536:CguZCa6S5khUIT6NvPzId4znOSjhLqxMUH9Ga/M1NIpPkUlB7583fjncFYIIp+F/:CgugapkhlT6J6aPjpqxvD/Ms8ULavLch

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4647b50ed71f9e1ab47db0ad95da6c9450e39c74cd2c674fc2543f830ade06bc.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3400

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

          Filesize

          674B

          MD5

          a5b5ff969bd86faec2aa38d07e611aa2

          SHA1

          3784139cd0654ed070d2e036b4e5bd4ffd7a5ad7

          SHA256

          5df11fb6f5cd66bbc4f15362ec58c557dfab89505c5d872d8ec0f550e190093f

          SHA512

          084dad851d2cd8962df3438d645e37d66d9c1ca47614054ba3a6d46210eb1571b28b76fe41e22412bddd15e675fcaf0bfc1cec9afb8d971acbc785c6c676ebc9

        • memory/3400-15-0x00007FFB9E3F0000-0x00007FFB9E400000-memory.dmp

          Filesize

          64KB

        • memory/3400-153-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-3-0x00007FFBA0D50000-0x00007FFBA0D60000-memory.dmp

          Filesize

          64KB

        • memory/3400-2-0x00007FFBA0D50000-0x00007FFBA0D60000-memory.dmp

          Filesize

          64KB

        • memory/3400-9-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-11-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-12-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-13-0x00007FFB9E3F0000-0x00007FFB9E400000-memory.dmp

          Filesize

          64KB

        • memory/3400-8-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-14-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-7-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-1-0x00007FFBE0D6D000-0x00007FFBE0D6E000-memory.dmp

          Filesize

          4KB

        • memory/3400-4-0x00007FFBA0D50000-0x00007FFBA0D60000-memory.dmp

          Filesize

          64KB

        • memory/3400-17-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-10-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-19-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-6-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-5-0x00007FFBA0D50000-0x00007FFBA0D60000-memory.dmp

          Filesize

          64KB

        • memory/3400-16-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-64-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-142-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-152-0x00007FFBE0D6D000-0x00007FFBE0D6E000-memory.dmp

          Filesize

          4KB

        • memory/3400-18-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-154-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-155-0x00007FFBE0CD0000-0x00007FFBE0EC5000-memory.dmp

          Filesize

          2.0MB

        • memory/3400-0-0x00007FFBA0D50000-0x00007FFBA0D60000-memory.dmp

          Filesize

          64KB