Analysis

  • max time kernel
    147s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2025, 13:32

General

  • Target

    CurrentlyCabinets/Domain.xlm

  • Size

    84KB

  • MD5

    5e0c9e51fb47ef175e4ac05da4909350

  • SHA1

    f45afb235f39430dc73ea32540f2d415db3d13b0

  • SHA256

    d8d4cb7e70347283b73285169bbf9b34f04fa416939594cdc5096851a28ff00c

  • SHA512

    f628a0b04b5c8f020ab8f14f5aa69bb70bcb5d2d02ac4abc941c0389e3da7f67526cf9922be015e369a7e52cbd7a418de661c479e473f531b99aab01dcd9f0d8

  • SSDEEP

    1536:AX9J/RsU4ci+4xcpsxavf4ujS030vLnGh+7TMUo5/lca+9j3te7soWvhlMcN:WJ/Rsth7cMavC030vjf7wl5/iaM3Q7Z4

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CurrentlyCabinets\Domain.xlm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5676

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    512b1818568d644726529de96e974d88

    SHA1

    46b5848cdbc5d75c65109288e90272c39ff41cf3

    SHA256

    728f1b7980f77f7ea67eee55992868ae343f0423e9c39d0ae755e832d5850229

    SHA512

    07121f27af6bc9964ccc79ed40116b9fa52456a42e0df2c9366080b06bd8a4e5079f82eaf6bccd636d95259293b861960d7bf81c906dd84a7b343116aa1cf8b5

  • memory/5676-12-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-16-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-5-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-4-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-0-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-6-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-8-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-9-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-7-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-10-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-11-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-13-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-14-0x00007FFB3CE30000-0x00007FFB3CE40000-memory.dmp

    Filesize

    64KB

  • memory/5676-1-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-2-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-17-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-15-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-19-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-20-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-18-0x00007FFB3CE30000-0x00007FFB3CE40000-memory.dmp

    Filesize

    64KB

  • memory/5676-21-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-31-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-32-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB

  • memory/5676-3-0x00007FFB7F6AD000-0x00007FFB7F6AE000-memory.dmp

    Filesize

    4KB

  • memory/5676-56-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-59-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-58-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-57-0x00007FFB3F690000-0x00007FFB3F6A0000-memory.dmp

    Filesize

    64KB

  • memory/5676-60-0x00007FFB7F610000-0x00007FFB7F805000-memory.dmp

    Filesize

    2.0MB