Analysis

  • max time kernel
    108s
  • max time network
    141s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2025, 13:32

General

  • Target

    CurrentlyCabinets/Im.xlm

  • Size

    51KB

  • MD5

    50bb0da553db2c393f8b4728879c7f44

  • SHA1

    76e7b3f76db3e9a01c86616b48fbc2f710ed7ce1

  • SHA256

    39b5653503c6caea22828846f89da180542adbdb7b8c1e0e396f32e779eda390

  • SHA512

    5bde5fd2ea83d5969ccf17362d86d2074af0e890320d10572dff35774f3596b6e908007a53a268fe09e98d26362b022ed41582a814157e87d2a0325eadf2ff80

  • SSDEEP

    1536:irYTt6z5M2ZSfD7hxKQ01XyZAGES/KejINEI6NbOmhb:ZTQz5BZs7hxKQiXhr6Nbrt

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CurrentlyCabinets\Im.xlm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5600

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    a4f8cac2397e2f605bbb2bf0dbd9993e

    SHA1

    4c71404032cb4ae9958a69f9727ff817e4b115a2

    SHA256

    56f6757ef5750b37dcf1b68f4dba5b069cc6416393aeab566401e5275c751139

    SHA512

    e897f472719c051a7c5b7436dd59cfcbdefc5da0914c77f7a5029fbe402f0925f346edece37d2a185fb768915d2605f413a873391729c46b41a9b08111ca2e8c

  • memory/5600-24-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-1-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-10-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-12-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-13-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-11-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-14-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-9-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-15-0x00007FFEB9B40000-0x00007FFEB9B50000-memory.dmp

    Filesize

    64KB

  • memory/5600-17-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-18-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-20-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-21-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-23-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-22-0x00007FFEB9B40000-0x00007FFEB9B50000-memory.dmp

    Filesize

    64KB

  • memory/5600-19-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-8-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-16-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-25-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-7-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-6-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-5-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-4-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-2-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-0-0x00007FFEFC503000-0x00007FFEFC504000-memory.dmp

    Filesize

    4KB

  • memory/5600-32-0x00007FFEFC503000-0x00007FFEFC504000-memory.dmp

    Filesize

    4KB

  • memory/5600-33-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-34-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-35-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB

  • memory/5600-3-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-57-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-56-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-59-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-58-0x00007FFEBC4F0000-0x00007FFEBC500000-memory.dmp

    Filesize

    64KB

  • memory/5600-60-0x00007FFEFC460000-0x00007FFEFC669000-memory.dmp

    Filesize

    2.0MB