Analysis

  • max time kernel
    23s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2024, 06:57

General

  • Target

    Erebus-master/local/2020-04-10-mssb.xlsx

  • Size

    2.0MB

  • MD5

    38e8f6c37833ccad83d74cedf5e949d1

  • SHA1

    89cca86bd5bfa041641f510f3bcd5c05a3ada026

  • SHA256

    8fd62c91d0edf3ba7a90d891f8113a1c1d8c62fd44c94bc4d481648a34111142

  • SHA512

    f8a5617492d9dc16bd5d64231ea2f605b08779ead8e23a614b67ad47b6840c34be9bb9126a06cf6eeab274d13bd5656543d88a28d4dbacb1dca8d1b97d1c07f9

  • SSDEEP

    49152:1xbSb/H0Vt7xMhl7Q0DICxR2thuuV4uA+OsQwVKc:vgcVbW9Q0DIC72pV4upOwN

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Erebus-master\local\2020-04-10-mssb.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    af724ae319717c0a83a19a5e656d48b6

    SHA1

    259c53d22595c58a2560432551662fa588ab6508

    SHA256

    fc73c906d7342a6f9370d5a307c96cc1c32a07127bac7c0b77e7217e4f33267a

    SHA512

    1af255734ce4a8ac4ac6ed97e5ba0dcd2aa7f0d4218d7dd3809b97d6f2faa5bfb6cdadf8d8be13eeba1cf1141e0511e9f295ebc67909703a7e19bd9c713eb0ab

  • memory/1752-13-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-18-0x00007FFB22ED0000-0x00007FFB22EE0000-memory.dmp

    Filesize

    64KB

  • memory/1752-4-0x00007FFB25730000-0x00007FFB25740000-memory.dmp

    Filesize

    64KB

  • memory/1752-3-0x00007FFB25730000-0x00007FFB25740000-memory.dmp

    Filesize

    64KB

  • memory/1752-5-0x00007FFB25730000-0x00007FFB25740000-memory.dmp

    Filesize

    64KB

  • memory/1752-7-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-6-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-8-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-9-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-11-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-12-0x00007FFB22ED0000-0x00007FFB22EE0000-memory.dmp

    Filesize

    64KB

  • memory/1752-10-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-15-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-14-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-16-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-17-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-2-0x00007FFB25730000-0x00007FFB25740000-memory.dmp

    Filesize

    64KB

  • memory/1752-19-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-0-0x00007FFB25730000-0x00007FFB25740000-memory.dmp

    Filesize

    64KB

  • memory/1752-20-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-38-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-31-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-34-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-21-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-37-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-42-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-46-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-45-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-44-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-43-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-41-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-40-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-39-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-36-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-35-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-33-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-32-0x00007FFB6574D000-0x00007FFB6574E000-memory.dmp

    Filesize

    4KB

  • memory/1752-47-0x00007FFB656B0000-0x00007FFB658A5000-memory.dmp

    Filesize

    2.0MB

  • memory/1752-1-0x00007FFB6574D000-0x00007FFB6574E000-memory.dmp

    Filesize

    4KB