Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-01-2025 06:04
General
-
Target
RHGP0987090H.xlsx
-
Size
2.1MB
-
MD5
55a94ebc4a3702f57aacb4633d36424e
-
SHA1
eb1cc363bbe0e61efcbb9fdb31d58b3cb714189e
-
SHA256
9bd66b6fa9050edf01d12180e4569c464f47e3235d5a912c9d2e91b6461e8f23
-
SHA512
adfcf48ac7cc0d40ee8665eee45147204a721fd3205febfd1ded8738104684ebbd74cf7e8fbef551cbd6c82b9999e1f9546918a79b3de7fb23d410ba82d0f5e1
-
SSDEEP
49152:cpfIiqBbNgp+blM1X2fjuQvW4hMalpBgNZVOhOPsTRYLXSOu:8eBbxby1ejuQvLxpBgNZghOSYud
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RHGP0987090H.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f31a3db9bc512f7b59bbd4d5efe4784d
SHA12921b7303352f41f64e01199ba890d5cc69c9745
SHA256d1ba432289acef57f3bf238588125971041d28075636ade8862fd511c696707e
SHA5126705d7badf5a83310ac488f5ff8295571e82db20bd08fdc10c0f02bb0f192fe06804e5e2e6fb5204d0f53eecceca094a4a0ed1f11b4414756a16e132529c8190
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB