Analysis

  • max time kernel
    108s
  • max time network
    128s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2025, 13:32

General

  • Target

    CurrentlyCabinets/Bd.xlm

  • Size

    76KB

  • MD5

    af517acf6d217684628c6bcb4ed1ddab

  • SHA1

    3489c329b329b90c912f5a652893edb1cae7fbdb

  • SHA256

    6d31707e60953f322824d872f2aef98fc9dd76215ab14b2b778e4148e2a9a144

  • SHA512

    a8bc0f70c10215c2de8f3a156e6eba2f5f60940aaef83fe3f96ae13ec406df5bcf02185c6cf625a258b22480846353b95d65ad7ed736f81afeabda34adf74b0f

  • SSDEEP

    1536:SeitUAbcPe0et/DZ9P7g9YArbMDB9BtcaBS0p:4KAbcOt/l9Tg1rb2OIS0

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CurrentlyCabinets\Bd.xlm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4200

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    2KB

    MD5

    438ca5da7baa8ca9e6353d7daf41be83

    SHA1

    fbb030977fc6488a8a45d1f9d2233e4c1b6f7fe4

    SHA256

    74516ba22fe27ed41bfe88990c589f336067e0560547603665e4ddd7872f35cd

    SHA512

    744048ac85d4594c1363ad3edf7726cafe8a9f2d1dbbbc71f34f7db48a3fd69674066d63ceb6931bfada18d7bf0e1713af28d89ae2b9eb5b89f0b3f538889617

  • memory/4200-17-0x00007FFF20DE0000-0x00007FFF20DF0000-memory.dmp

    Filesize

    64KB

  • memory/4200-19-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-2-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-4-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-5-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-6-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-8-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-10-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-9-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-7-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-11-0x00007FFF20DE0000-0x00007FFF20DF0000-memory.dmp

    Filesize

    64KB

  • memory/4200-12-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-13-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-15-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-14-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-1-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-3-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-20-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-16-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-21-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-22-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-18-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-29-0x00007FFF63923000-0x00007FFF63924000-memory.dmp

    Filesize

    4KB

  • memory/4200-30-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-31-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-32-0x0000026B66320000-0x0000026B66477000-memory.dmp

    Filesize

    1.3MB

  • memory/4200-33-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB

  • memory/4200-0-0x00007FFF63923000-0x00007FFF63924000-memory.dmp

    Filesize

    4KB

  • memory/4200-64-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-63-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-66-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-65-0x00007FFF23910000-0x00007FFF23920000-memory.dmp

    Filesize

    64KB

  • memory/4200-68-0x00007FFF63880000-0x00007FFF63A89000-memory.dmp

    Filesize

    2.0MB