Analysis

  • max time kernel
    108s
  • max time network
    220s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 12:06

General

  • Target

    TvcomFreight/Euro.xls

  • Size

    94KB

  • MD5

    d469b9ac05657dcc68db99926bcef248

  • SHA1

    0f806e115a21ae525576c38ec249edc2a7c7b7c5

  • SHA256

    a87eca97001728a9f08f7a01e4af5962315a31206757bbd844ee132f1b284b77

  • SHA512

    0a4ddbeddb2931c545f7c9924e42679298457b6f7336196d0608c6ba4337666e74abd7aa480c1e692e0d516cc8738cf9f2d3bb1989dd4d01408bc536c4ffe3d4

  • SSDEEP

    1536:l1Ya1SAMLBBQphS4gdNrGs3juRXmGUZdXaEUlw0zpL94L+MRaswtubvj1p5Giur:lPYFephrujuRUXaxm00K0aswt+71pXW

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TvcomFreight\Euro.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3492

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

          Filesize

          1KB

          MD5

          0fd21ac973ed034036cd64616c6c15b9

          SHA1

          b5e7b07df814049e212186d855b2b424635a9a3d

          SHA256

          335ca27bb7a2f97e2184f2611ac42e2577575938e360c05d3048110ec7e70fd9

          SHA512

          5eb449ed0e11e078a29ef9e00eb56bbcc438f60c5bff668074f1011268e47936530ba6cd695395b08be3a904fa2543473beb0bf8de05d789570ed95003c95cef

        • memory/3492-8-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-11-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-2-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB

        • memory/3492-5-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB

        • memory/3492-4-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB

        • memory/3492-0-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB

        • memory/3492-9-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-12-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-13-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-10-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-3-0x00007FF9ABCAD000-0x00007FF9ABCAE000-memory.dmp

          Filesize

          4KB

        • memory/3492-14-0x00007FF9698A0000-0x00007FF9698B0000-memory.dmp

          Filesize

          64KB

        • memory/3492-26-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-7-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-6-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-25-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-15-0x00007FF9698A0000-0x00007FF9698B0000-memory.dmp

          Filesize

          64KB

        • memory/3492-1-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB

        • memory/3492-50-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB

        • memory/3492-53-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB

        • memory/3492-52-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB

        • memory/3492-54-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-55-0x00007FF9ABC10000-0x00007FF9ABE05000-memory.dmp

          Filesize

          2.0MB

        • memory/3492-51-0x00007FF96BC90000-0x00007FF96BCA0000-memory.dmp

          Filesize

          64KB