Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-11-2024 12:17
General
-
Target
14E11B88.xls
-
Size
29KB
-
MD5
9fba7fbd5906be19a22a8df0baea3f8e
-
SHA1
6648d7997e3af6f190022dc7dbe4bb5781bc5905
-
SHA256
fab850a4a5c67c038babb9892f805555ae07e95a922577085f56ff810eedf876
-
SHA512
af9497508f6b887ddea0da603e63e876286e3a239aec57051de9f1812728a3e1f9492c10fab9c642c16be8fd358340fded723b8a066aba57b1f8f5c86a353be1
-
SSDEEP
384:uvSof29taGeqt57hWG7ASVHjHmZHiTWMXBw1HSdb:Vof23aGeqt57hWG79HbY62wb
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\14E11B88.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
907B
MD575b8ae072b04a350b1df39d1f2e2ece4
SHA1364363a151a86f85f49b8cf272bf63c05355835c
SHA256d85d7b346cc4912ab4092b269aaa9864d0e1aa67b52e0cfacf711df9d0427747
SHA512f7ef701fe056954d9d4a08ed0a397a3326c5fe8ecb704a47c1631ff2a9235a9be2a4865f1fa8b433872e7631e0cd76a0739b3b6407c704741f5bd05705556ca0
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB