Analysis

  • max time kernel
    133s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-11-2024 17:39

General

  • Target

    setfsb/Creator.xls

  • Size

    53KB

  • MD5

    5d3c5f9fe4ca09cebc0386abf47031c0

  • SHA1

    03bb80a37dee81c216f0925c7d6746538c1c0f49

  • SHA256

    f10cc8c2807378b4e60b330011e50cb58a2cebc2763e51ebf0c3de8a8d96a1a4

  • SHA512

    7b4e513f6803cbb532a6e106e9c9c29fbb2e0d836c2fb0472b3e8281501e776801569bbdd5a6668d9ba3c9070fb78ec059ba8fa79bbce54784c32c5fcf3f8082

  • SSDEEP

    1536:PJTv0zKq8cMeXJFLUqOFN3bYmlL/rhclIN:lOKqYyFLU/FxbYmlL/rSlIN

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\setfsb\Creator.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2212-1-0x00007FFE9486D000-0x00007FFE9486E000-memory.dmp

    Filesize

    4KB

  • memory/2212-0-0x00007FFE54850000-0x00007FFE54860000-memory.dmp

    Filesize

    64KB

  • memory/2212-5-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-6-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-7-0x00007FFE54850000-0x00007FFE54860000-memory.dmp

    Filesize

    64KB

  • memory/2212-9-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-10-0x00007FFE521E0000-0x00007FFE521F0000-memory.dmp

    Filesize

    64KB

  • memory/2212-8-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-4-0x00007FFE54850000-0x00007FFE54860000-memory.dmp

    Filesize

    64KB

  • memory/2212-12-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-13-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-15-0x00007FFE521E0000-0x00007FFE521F0000-memory.dmp

    Filesize

    64KB

  • memory/2212-16-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-18-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-17-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-14-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-11-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-3-0x00007FFE54850000-0x00007FFE54860000-memory.dmp

    Filesize

    64KB

  • memory/2212-2-0x00007FFE54850000-0x00007FFE54860000-memory.dmp

    Filesize

    64KB

  • memory/2212-28-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB

  • memory/2212-29-0x00007FFE9486D000-0x00007FFE9486E000-memory.dmp

    Filesize

    4KB

  • memory/2212-30-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

    Filesize

    2.0MB