Analysis
-
max time kernel
131s -
max time network
256s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-01-2025 11:07
General
-
Target
malware-samples-master/mitre-attack/Emotet+Trickbot_comparison.xlsx
-
Size
14KB
-
MD5
248cd700a82449f4b0d107e6a934ae2b
-
SHA1
d1763d827d614ddd6f3ca046ec6d1cf880f4dc25
-
SHA256
6ff88255226a7f0de338e8383904a6fd8af5eb630c28ae6846b107de41fa22ef
-
SHA512
c5755cc015b3e6aa30ce1c87c05a7712fc7939f57d7d470025a50c8d280ad53d97701f34b85b8f9300652989720915ccac28a22925e73ea48455116f37c31746
-
SSDEEP
384:YlbZERmunyjfOOTXC6ACMYMx3pF5dBwDVfJZKTvazDpzQ:OdunyXXC6jzqTKVxZ7zDC
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\malware-samples-master\mitre-attack\Emotet+Trickbot_comparison.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\ResolveDisconnect.pps" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177KB
MD58678e6e6ba297f0870618d262a6193b5
SHA1986100b8762a185c28a39ce25a81a18b2df8ff02
SHA256cb4eed1356794ed167662cedabd7634440900e58ab00f3a594d2a95ce9756067
SHA512ac2ad95db376005df8d438e35f726f7403279052d5c978de77cbfb4e735b9b2b8a56a9dbd22f43c7d9894750357f0294ad76a83efd1461290c80c8abe0b0cc26
-
Filesize
2KB
MD5beb04f4eae8c5a7d246ea03003c2636c
SHA14d43f0339450121b741b4347e5b4713b2622b11a
SHA256f0bc7b460f9bc44d2a4dfc83c418fac64f2d70e4475ece90557c8e792763d443
SHA512b17390cb3e7222f6de3194a5bed5fd4d29edbe56811acc251dc4144aac9cf19074a28cd18cdaf8a4cb9f20e943968f04d57f55535ec0aa1e49aa7b1dc8517ff2
-
Filesize
2KB
MD5308776a5b7a637efdfca76f5959328f3
SHA121f3b80672c462ddc1ceafc9620a04f479a69ac8
SHA25627dc2a66322ebfdee42c9e2b74acb671e68717ba26310b36bd0a74dfd2dc1d73
SHA512b2ca2a57e27214465972141404efd29aae75cd93f0a80269a9503b01282ac2915c437d1b33292710ec4107fdadce85c791e1c6bc465792353561b5104e40a206
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB