Analysis

  • max time kernel
    109s
  • max time network
    127s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2025, 13:32

General

  • Target

    CurrentlyCabinets/Domain.xlm

  • Size

    84KB

  • MD5

    5e0c9e51fb47ef175e4ac05da4909350

  • SHA1

    f45afb235f39430dc73ea32540f2d415db3d13b0

  • SHA256

    d8d4cb7e70347283b73285169bbf9b34f04fa416939594cdc5096851a28ff00c

  • SHA512

    f628a0b04b5c8f020ab8f14f5aa69bb70bcb5d2d02ac4abc941c0389e3da7f67526cf9922be015e369a7e52cbd7a418de661c479e473f531b99aab01dcd9f0d8

  • SSDEEP

    1536:AX9J/RsU4ci+4xcpsxavf4ujS030vLnGh+7TMUo5/lca+9j3te7soWvhlMcN:WJ/Rsth7cMavC030vjf7wl5/iaM3Q7Z4

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CurrentlyCabinets\Domain.xlm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2572

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    f54f3783ad02889946a50c6da65cc802

    SHA1

    c579db1e7a338121194c30cd9b19b5001a05c979

    SHA256

    b864ae2d840c6a21e5a44b77f682ed9079dc46b45069a3a26099dfaad9641bdf

    SHA512

    e545732282ae728c2b78bfcea00141dd2d0ab9562c6092723354e48b5b8e1035a4e97d5947433a4b23695edc960a87e2f8a3ef006d9f352560dcd02b0ce2a53e

  • memory/2572-16-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-17-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-4-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-6-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-7-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-5-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-2-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-8-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-11-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-10-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-13-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-12-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-14-0x00007FF892810000-0x00007FF892820000-memory.dmp

    Filesize

    64KB

  • memory/2572-9-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-3-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-15-0x00007FF892810000-0x00007FF892820000-memory.dmp

    Filesize

    64KB

  • memory/2572-20-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-18-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-0-0x00007FF8D4A43000-0x00007FF8D4A44000-memory.dmp

    Filesize

    4KB

  • memory/2572-21-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-19-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-28-0x00007FF8D4A43000-0x00007FF8D4A44000-memory.dmp

    Filesize

    4KB

  • memory/2572-29-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-30-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-31-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB

  • memory/2572-1-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-56-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-57-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-55-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-58-0x00007FF894A30000-0x00007FF894A40000-memory.dmp

    Filesize

    64KB

  • memory/2572-59-0x00007FF8D49A0000-0x00007FF8D4BA9000-memory.dmp

    Filesize

    2.0MB