Analysis

  • max time kernel
    109s
  • max time network
    137s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2025, 13:32

General

  • Target

    CurrentlyCabinets/Listen.xlm

  • Size

    72KB

  • MD5

    65e37887ffc09daba6eb5fcd1bf8f37c

  • SHA1

    f190189a1a39a03a8678f317b0d76116eb03c65f

  • SHA256

    e7b907cbc40deeabba0351fb2cce16cfde384ddd687d578a282388a222d9c804

  • SHA512

    fbbd91495552a1feb8b9169be007ea8018292fa8394fb992e992997a8ae4953f436be50d97841d4a212c2afba47240edad5e0f540c3ca23c7d02c6642ffcafc8

  • SSDEEP

    1536:2IgP9jJri4w8vYcS+4tXjwM6M29/gdXsF+K4IFxXKL53EhPif9htIlM4AEOQ7:2IgtJ2NtXMM6D/gg+KjFxXKuUlpQ7

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CurrentlyCabinets\Listen.xlm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:888

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    9d36cc66ec89395283eb00d3ee4eb129

    SHA1

    b5fbb91a8f0bd55e41fb8cd928e95467df23be8e

    SHA256

    7a493eb4acbf60a3abb1e997ed9690632d684962ff45a7df05b715256dc2d7d3

    SHA512

    957f54fed8aca9cf8e53a574582471fc5f1207f8d3b95a8c2da12b29cfd5ee21d7d374d077b1f554141273c7fad8b39da47272406315417b3f4a26c6e1b81e97

  • memory/888-24-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-7-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB

  • memory/888-13-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-14-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-15-0x00007FFC96990000-0x00007FFC969A0000-memory.dmp

    Filesize

    64KB

  • memory/888-12-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-10-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-8-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-16-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-18-0x00007FFC96990000-0x00007FFC969A0000-memory.dmp

    Filesize

    64KB

  • memory/888-19-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-17-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-21-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-22-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-20-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-6-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-11-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-5-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB

  • memory/888-23-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-4-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-3-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB

  • memory/888-2-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB

  • memory/888-1-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB

  • memory/888-0-0x00007FFCD8F83000-0x00007FFCD8F84000-memory.dmp

    Filesize

    4KB

  • memory/888-31-0x00007FFCD8F83000-0x00007FFCD8F84000-memory.dmp

    Filesize

    4KB

  • memory/888-32-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-33-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-9-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-61-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

    Filesize

    2.0MB

  • memory/888-60-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB

  • memory/888-59-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB

  • memory/888-58-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB

  • memory/888-57-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

    Filesize

    64KB