Analysis
-
max time kernel
133s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-01-2025 01:19
General
-
Target
738707987b72581ad79125873cba6b2f4084638a46f6ae79fe4a39fd5cea2f8e.xlam
-
Size
658KB
-
MD5
bbd5e5f3f0b564fdbb6c5730beb38f6e
-
SHA1
eaacf1cd766f9556a7efb283528edd536f2c10c3
-
SHA256
738707987b72581ad79125873cba6b2f4084638a46f6ae79fe4a39fd5cea2f8e
-
SHA512
9e47e888e7e5e39c79618235958a09e915511ff4152de091c3fb98a1e2099b6867efc7a772637d3b207d8e6e689801b851d5624a0535bfaf7df4119e9c48b7bf
-
SSDEEP
6144:qWWhzVPPsvIvG2ViKe4dPXdsCY9J5xi3MniJipLCJuluzCTItOyzA3cSWrkWMyrb:Al1Pfe4g5D5EMIJJ7A3K3VaP6qJ+Mi
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\738707987b72581ad79125873cba6b2f4084638a46f6ae79fe4a39fd5cea2f8e.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5213f7633cdd77309cf2b546c21a3b1b6
SHA16ace7b9b9a0ac2e773f38471a533ced296ff7d59
SHA25630b8e0f393d0d026a48543d7b6cce7dc0c90eddca27d94651e4eb16c5fc7ea15
SHA51233f17900fe6b088f47d7fbac8ef9ca2868bd34c42b6e1f98e6ab8dc69e43f8325ab9d815f9ca62852816d5a0c19d7572f1f764fe1a78badd3015ae0e1e96bdfe
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB