Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 21:48
General
-
Target
5e45c73a32cab5efa7196095c8842acb4ba13ce974e96f8190dd6ad0dd819f1e.xlsx
-
Size
2.2MB
-
MD5
dcd0d55f67330db999c89471cd01aa8f
-
SHA1
d994c44da5b32cdbf51917de57ed78968feaa639
-
SHA256
5e45c73a32cab5efa7196095c8842acb4ba13ce974e96f8190dd6ad0dd819f1e
-
SHA512
36da20e927fe523e6926a41efad0052a37e706a6f934c3e9495b0b2764ae179e2027c72e81919a037a71ce4b99063c6b20b929f57a182111726968085954bf00
-
SSDEEP
49152:4xfNNNNNNrv7RQKckqaI4WOhyHaAdAVG4dM3aQSsyhgKm7PXiQsWpdC:0VTeaIEocV7gCHmKkq/
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5e45c73a32cab5efa7196095c8842acb4ba13ce974e96f8190dd6ad0dd819f1e.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD557dfdc3882572e76e665a32f33362855
SHA1e4f66e5ab813a02ef37e164af7c93b0121e68b45
SHA256a885183de2ad3f3b1ac920d7782b8aae5e6995e1c7964eb523a00956ee0cc887
SHA51236e065c954473708892bda5ad7fc5cfadb946018a44abccaaa63f78fe47314adfd0d836b8fe88f2b992d4a4c54b68fee365d8c32ec223a507b00046716bc95f2
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB