Overview

overview

8

Static

static

1

51396027.exe

windows7-x64

8

51396027.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2025, 14:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    51396027.exe

  • Size

    10.5MB

  • MD5

    59a9cba43d9dd78d248ec074353756b9

  • SHA1

    da08c31f59fdf099474fa43205fb7f352d80edb2

  • SHA256

    dc3d08cc406d15bb457ae7c5f678e379cdd98c8297d08b8d1b5ead62adfe1857

  • SHA512

    0b8c9341774d3cb55d3a1d679e99621fc240e75c7a86aefa3b888546d1fdf5ff281e448a6a526882097efaa73357e2f32b90d6b4714a759821358a3d90d723bb

  • SSDEEP

    196608:QUbJDQhT+BJpGuGfWFLiAt+ZtwpMskNvjfG2nu/CmaaFhEUrue6TwGdwCNkYSxfF:QUblWqJpnGeAtwCbNvS2GCmaNuue6TNy

Score
8/10
discoverymacromacro_on_action

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51396027.exe
    "C:\Users\Admin\AppData\Local\Temp\51396027.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
      2⤵
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\202104141400\UpFile\DaProcess\SettingPdf\Ü—^Žx•¥“Í_—¼–Ê.rdlx
    Filesize

    726KB

    MD5

    deac0d51adda2b77eefffa1888fad4a3

    SHA1

    2ed3e202fa9dca660aba03f51ac79bc037df05db

    SHA256

    d5ce1c73145ceeb44d88719dd7f3a23b00d19a6817bb1cd647c8f11c2274bec1

    SHA512

    89677b2c5f00ec14cc7ca61af50a06856226a96bc1ca2588d7b10ba43a8eadbb2d8beba04c35b95affb48798b477f996651cc9cac8c52bae065650af91081b18

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\202104141400\UpFile\DaProcess\SettingPdf\Ü—^•sŽx‹‹•ñ‘_—¼–Ê.rdlx
    Filesize

    261KB

    MD5

    13afe5e46d9c6bc300f502086d988ddb

    SHA1

    52944507e6c94231d522b0e5c32515adb2c8e5e2

    SHA256

    67fedaafb2b2c7b54e1c4799d84c1a06b2f7b17256abf3add2e8a1b9b420d566

    SHA512

    af6b64da4cc8a934c35ed6c05f6a469c7187f60f27f0056a7aafaa7a5c48af058b437eb28f154d487ab6c11bc761858e56aa376fddb1e75c674504f1cf125e1f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\202104141400\ƒo[ƒWƒ‡ƒ“ƒAƒbƒv.xls
    Filesize

    249KB

    MD5

    23bc19b9644bd87a03c41f1189dba6dc

    SHA1

    d9115217854525600b400f1969db6003753eb52b

    SHA256

    d0c1257124fac22c0914262d6234f6501692959f70b1a41a7cc0c7258ef22e08

    SHA512

    cb4c5cbb0399391ab4beec677514297ff0114499b87d323eca230524e8f995a0a2834bb49f02e94fc775f7ef513ccf08d99b5d082615f96a47bc9e01ec85c9fa

    Download Submit

  • memory/2400-246-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2400-247-0x0000000071FCD000-0x0000000071FD8000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2400-255-0x0000000007650000-0x0000000007750000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2400-257-0x00000000006F0000-0x00000000007F0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2400-258-0x00000000006F0000-0x00000000007F0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2400-268-0x00000000006F0000-0x00000000007F0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2400-270-0x0000000071FCD000-0x0000000071FD8000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2400-271-0x00000000006F0000-0x00000000007F0000-memory.dmp

    Filesize

    1024KB

    Download