Analysis

  • max time kernel
    108s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2025, 13:32

General

  • Target

    CurrentlyCabinets/Amendment.xlm

  • Size

    65KB

  • MD5

    c3252746626d138fa47f851080e72680

  • SHA1

    0af57eacd1bd92b3d4d65a499c1a8d814f2bc904

  • SHA256

    bad626885fc7bd356f0872d979055ca38d2b92a8921ee35dced8e0622495f921

  • SHA512

    e3e24adb8da7dc66d6322f2a4dbb00e53567fea6f9692464d96d1ee8c02f8847043e02ed89d5282a07bfcb393326e39856b7b095860557a8b7bf4ef057d5badc

  • SSDEEP

    1536:6367viKjm6ryI3QZ24N6U7uLNjj3VU1iJmuzge:3uKjmSyGQZzN6USLRqcJHz5

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CurrentlyCabinets\Amendment.xlm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1008

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    2KB

    MD5

    cace5818bf18fd8a66c8480d181bf08e

    SHA1

    66ed2c399954044ca7a69b053853c50511f3e2b6

    SHA256

    13162c8c769b16c3209919eec77ce6f7c5ae6c46909328f9e72c17f33c348780

    SHA512

    842b86e1cf03d7c77f9d5b3bc9b115fc2e87c43a7d57942ff88e2c8c7bae03316d7d0c8ee5f645a0e9da2d32c3dbe55d976f8013b4ad25d975bed54b14c26136

  • memory/1008-22-0x00007FF82E200000-0x00007FF82E210000-memory.dmp

    Filesize

    64KB

  • memory/1008-16-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-6-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-8-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-9-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-7-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-5-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-4-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-10-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-14-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-17-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-19-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-20-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-21-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-23-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-2-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-3-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-15-0x00007FF82E200000-0x00007FF82E210000-memory.dmp

    Filesize

    64KB

  • memory/1008-18-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-13-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-12-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-11-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-0-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-33-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-35-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-34-0x00007FF8708ED000-0x00007FF8708EE000-memory.dmp

    Filesize

    4KB

  • memory/1008-36-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB

  • memory/1008-1-0x00007FF8708ED000-0x00007FF8708EE000-memory.dmp

    Filesize

    4KB

  • memory/1008-60-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-61-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-62-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-63-0x00007FF8308D0000-0x00007FF8308E0000-memory.dmp

    Filesize

    64KB

  • memory/1008-64-0x00007FF870850000-0x00007FF870A45000-memory.dmp

    Filesize

    2.0MB