5b838d9c51ae74156d6b890e1428d448cf4fedb90f156c9210908f899ce20d61

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23/03/2025, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

南沙万顷沙镇水窦工程量清单/南沙万顷沙镇水窦/11#水窦/表3—1 封面.xls
Size

16KB
MD5

107fcba4b4e0dd50a24aeeb3c9fec45a
SHA1

241e10332826e56812d83b33eef4f2a32e792d4a
SHA256

bd68adb6a55d24c3630c15aa52a017fc582ef5d809dbf2134d341e7d2ed10814
SHA512

8efd5d2d188006d9870b5d3638a590b18b1d613e1aeaa2d17745d1268ea525025f32298ab863aeea31f4b571ebf0d44270a3e54f6cbf0ba3a540d17c8f19cc28
SSDEEP

96:KYhZ2G2pBOVR2lNIUmdjqYwIZRiQ6RycvyxKz/cb2BaZHeZlQegRT:KYhZ2G2pBWR2THLR/vyy6egJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2776	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2776	EXCEL.EXE
2776	EXCEL.EXE
2776	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\南沙万顷沙镇水窦工程量清单\南沙万顷沙镇水窦\11#水窦\表3—1 封面.xls"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-1-0x000000007243D000-0x0000000072448000-memory.dmp

Filesize
44KB

Download
memory/2776-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2776-2-0x000000007243D000-0x0000000072448000-memory.dmp

Filesize
44KB

Download