Analysis

  • max time kernel
    108s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2025, 13:32

General

  • Target

    CurrentlyCabinets/Moderators.xlm

  • Size

    65KB

  • MD5

    7e1c5fa194a36feffe2c74c50d9cc890

  • SHA1

    56a11ff8811a9222f4604f53eb577335871f56a4

  • SHA256

    0f6b522268f8cd4f418f6aa395e9be1270f7d056760ee47da9e73e632fd7bdac

  • SHA512

    9c08a99225be517f79fb0fe18ba866a45abdc4a012118837b51970a19900580c3d1410761381a46f5e07a0539fd713aa383bbc4a12bceb79f248ae880f5c9956

  • SSDEEP

    1536:tDjMG5axkAqDX+cex4+eZduTS3NvX+KJ5t8II+G79:tDtE8v/+e6TYvu0/8iC

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CurrentlyCabinets\Moderators.xlm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5644

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    bbb1de24271aa52a73cfba1d81fc77ff

    SHA1

    f5876e943e23d2ee86578d9a7625e9c5459d2bf5

    SHA256

    aa4e84dc43a6ac6e52c05aef535e42e19f7e962453fa51535ba0bd1052b2b219

    SHA512

    dca4c208ced897e2738ed9ddfe40868db973264da8a56f8f67f07d07cac578d92a60752e2bf4c462412379351ad74e332ef32633142ba40a7202dbd9af4e993e

  • memory/5644-18-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-23-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-2-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-7-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-10-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-11-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-9-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-8-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-6-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-1-0x00007FFA564AD000-0x00007FFA564AE000-memory.dmp

    Filesize

    4KB

  • memory/5644-14-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-13-0x00007FFA143A0000-0x00007FFA143B0000-memory.dmp

    Filesize

    64KB

  • memory/5644-12-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-16-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-17-0x00007FFA143A0000-0x00007FFA143B0000-memory.dmp

    Filesize

    64KB

  • memory/5644-3-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-4-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-22-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-15-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-21-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-20-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-19-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-0-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-35-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-36-0x00007FFA564AD000-0x00007FFA564AE000-memory.dmp

    Filesize

    4KB

  • memory/5644-37-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-38-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB

  • memory/5644-5-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-63-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-62-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-65-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-64-0x00007FFA16490000-0x00007FFA164A0000-memory.dmp

    Filesize

    64KB

  • memory/5644-66-0x00007FFA56410000-0x00007FFA56605000-memory.dmp

    Filesize

    2.0MB