Analysis

  • max time kernel
    109s
  • max time network
    133s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2025, 13:32

General

  • Target

    CurrentlyCabinets/Amendment.xlm

  • Size

    65KB

  • MD5

    c3252746626d138fa47f851080e72680

  • SHA1

    0af57eacd1bd92b3d4d65a499c1a8d814f2bc904

  • SHA256

    bad626885fc7bd356f0872d979055ca38d2b92a8921ee35dced8e0622495f921

  • SHA512

    e3e24adb8da7dc66d6322f2a4dbb00e53567fea6f9692464d96d1ee8c02f8847043e02ed89d5282a07bfcb393326e39856b7b095860557a8b7bf4ef057d5badc

  • SSDEEP

    1536:6367viKjm6ryI3QZ24N6U7uLNjj3VU1iJmuzge:3uKjmSyGQZzN6USLRqcJHz5

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 41 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CurrentlyCabinets\Amendment.xlm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2748

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    b9337be07968a49fdd3ac285f742f87e

    SHA1

    4f04c3e33d4ffe0d4c1fdb22f085fe36ec415b8b

    SHA256

    494b9705740e4075d978afa4dbdd8d521600953dd7c37166ba9039a96d84f58a

    SHA512

    9ceee05b695c8e16ec1ec8190c788e715e4058356c2c0025ea1ebec55c06b685df094d1dd34efb8e49a78382428d90482b3ff6e79d7325335f3f49ae021215e6

  • memory/2748-3-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-8-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-10-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-11-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-13-0x00007FFCFFF30000-0x00007FFCFFF40000-memory.dmp

    Filesize

    64KB

  • memory/2748-12-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-7-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-14-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-17-0x00007FFCFFF30000-0x00007FFCFFF40000-memory.dmp

    Filesize

    64KB

  • memory/2748-18-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-16-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-15-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-19-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-21-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-22-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-25-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-24-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-23-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-20-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-6-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-2-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-4-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-5-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-1-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-0-0x00007FFD42643000-0x00007FFD42644000-memory.dmp

    Filesize

    4KB

  • memory/2748-33-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-32-0x00007FFD42643000-0x00007FFD42644000-memory.dmp

    Filesize

    4KB

  • memory/2748-34-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-39-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-41-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-43-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-42-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-40-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-38-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-37-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-36-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-35-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-44-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-9-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2748-66-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-67-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-68-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-65-0x00007FFD02630000-0x00007FFD02640000-memory.dmp

    Filesize

    64KB

  • memory/2748-69-0x00007FFD425A0000-0x00007FFD427A9000-memory.dmp

    Filesize

    2.0MB