Analysis
-
max time kernel
1s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 07:48
General
-
Target
ae807193017b1f9f641c7a61d8c087e07e9295927213d5bac1332f4241d2c2b7.xls
-
Size
1.1MB
-
MD5
5c9e71f079fa7898e1072995ec0cc340
-
SHA1
6def3110406375acceb62b1574524008674e5b67
-
SHA256
ae807193017b1f9f641c7a61d8c087e07e9295927213d5bac1332f4241d2c2b7
-
SHA512
7b9c22e9833eda122999903c19bf5575e02250862a592cadff193e400c01940c9681c43ffea6aa75cb4f9df7117ee14fbe4bd98ced78005216664c5ae3874d0b
-
SSDEEP
24576:auq9PLiijE2Z5Z2amHEX01xb9+k5HbW3kKe1K6wxf3G8:auEPLiij7Z5ZKkXiB9l5HbWUpwh
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ae807193017b1f9f641c7a61d8c087e07e9295927213d5bac1332f4241d2c2b7.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB