Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
28/03/2025, 14:35
General
-
Target
51396027.exe
-
Size
10.5MB
-
MD5
59a9cba43d9dd78d248ec074353756b9
-
SHA1
da08c31f59fdf099474fa43205fb7f352d80edb2
-
SHA256
dc3d08cc406d15bb457ae7c5f678e379cdd98c8297d08b8d1b5ead62adfe1857
-
SHA512
0b8c9341774d3cb55d3a1d679e99621fc240e75c7a86aefa3b888546d1fdf5ff281e448a6a526882097efaa73357e2f32b90d6b4714a759821358a3d90d723bb
-
SSDEEP
196608:QUbJDQhT+BJpGuGfWFLiAt+ZtwpMskNvjfG2nu/CmaaFhEUrue6TwGdwCNkYSxfF:QUblWqJpnGeAtwCbNvS2GCmaNuue6TNy
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 21 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51396027.exe"C:\Users\Admin\AppData\Local\Temp\51396027.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\202104141400\ƒo[ƒWƒ‡ƒ“ƒAƒbƒv.xls"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
726KB
MD5deac0d51adda2b77eefffa1888fad4a3
SHA12ed3e202fa9dca660aba03f51ac79bc037df05db
SHA256d5ce1c73145ceeb44d88719dd7f3a23b00d19a6817bb1cd647c8f11c2274bec1
SHA51289677b2c5f00ec14cc7ca61af50a06856226a96bc1ca2588d7b10ba43a8eadbb2d8beba04c35b95affb48798b477f996651cc9cac8c52bae065650af91081b18
-
Filesize
261KB
MD513afe5e46d9c6bc300f502086d988ddb
SHA152944507e6c94231d522b0e5c32515adb2c8e5e2
SHA25667fedaafb2b2c7b54e1c4799d84c1a06b2f7b17256abf3add2e8a1b9b420d566
SHA512af6b64da4cc8a934c35ed6c05f6a469c7187f60f27f0056a7aafaa7a5c48af058b437eb28f154d487ab6c11bc761858e56aa376fddb1e75c674504f1cf125e1f
-
Filesize
249KB
MD523bc19b9644bd87a03c41f1189dba6dc
SHA1d9115217854525600b400f1969db6003753eb52b
SHA256d0c1257124fac22c0914262d6234f6501692959f70b1a41a7cc0c7258ef22e08
SHA512cb4c5cbb0399391ab4beec677514297ff0114499b87d323eca230524e8f995a0a2834bb49f02e94fc775f7ef513ccf08d99b5d082615f96a47bc9e01ec85c9fa
-
Filesize
1KB
MD5db50abfa50f13bbde176e63b58db57bd
SHA1c861db011b4fceaaedf8fce838319ca8880573ea
SHA256bc34544710e5a6ede6e136f1e50a9758b70073e0757e2b70ad213c8f8807d6e7
SHA5122a59b8e1132ed24eaed7fae67e07e601c478de3838deea358f9bf19e5e3693beb3933980c082e8c54d07db918de2b307ea06c46fb42e6c7cd8b8a7681b12ea3e
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB