Analysis
-
max time kernel
94s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-01-2025 01:05
General
-
Target
d08da428bc6f02839f81ccd9bcfe41bf802e4b6d3a7f42dd682c424f2ca7116c.xlam
-
Size
602KB
-
MD5
f4e07aa9c08dd390d4242d4571170f0c
-
SHA1
71d0534361571acf8b25c8f133b6c17c4a0750b1
-
SHA256
d08da428bc6f02839f81ccd9bcfe41bf802e4b6d3a7f42dd682c424f2ca7116c
-
SHA512
da236f5f6059fb2edc7794fdda8063eb03f03606800902f8e0e0c72ca5d08754d38803c2f366aebb83327cfcbd83e545adea53fa5e932d112e395a2b32db4741
-
SSDEEP
12288:qug9jk/7Y9A+Xcy6x0r0Y0V3IXiLsQ/3Li8AlSecC5qpAwR6aOQwm:y9S+Myajrpb1/3qS4C6aqm
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d08da428bc6f02839f81ccd9bcfe41bf802e4b6d3a7f42dd682c424f2ca7116c.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5496df60c1d63b68f4c366ad1616c798f
SHA1bb99fde92eac40d546380df493e4e40bf11b6930
SHA2560cd9ff922e4ef6f12bb7081cfa8ee616fc1ff608fa5f9aa91293c783ce0610d1
SHA512b955e4d1de8900ea3eaed05b80787772f6e291515dcb0409cbd76c4e22f9bbfb9719032a8dd1cddf569d03a56b62081a016e41ac463ae1df3b07ca7e31ce4288
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB