Analysis

  • max time kernel
    108s
  • max time network
    214s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 12:06

General

  • Target

    TvcomFreight/Observer.xls

  • Size

    52KB

  • MD5

    44c2060e55b67e3a1e6c1c6d9718732a

  • SHA1

    0517ad7625d36b11a8ce2bb8f10d9ff196d5dc20

  • SHA256

    c71df96688a046f890fa005f28b89b9a806e4519db689f55914aeb3ac04390e5

  • SHA512

    087b07b06a84ea9b93779028aa80423624d8a038d5f8f2e8b57397d2afd2046230d31ede1bf40f1ca778a4af7a8d89d4cddd97fd025fbe0d48dfff3c12465312

  • SSDEEP

    1536:o1xroDpYYzJFvVwuYcXIYDj013l3uyv84vcbO:KroWkvq+IYP0vuyv84vcC

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TvcomFreight\Observer.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:5944

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5944-0-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-3-0x00007FFD19E0D000-0x00007FFD19E0E000-memory.dmp

          Filesize

          4KB

        • memory/5944-2-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-1-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-4-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-5-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-10-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB

        • memory/5944-9-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB

        • memory/5944-11-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB

        • memory/5944-8-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB

        • memory/5944-12-0x00007FFCD7D90000-0x00007FFCD7DA0000-memory.dmp

          Filesize

          64KB

        • memory/5944-7-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB

        • memory/5944-6-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB

        • memory/5944-13-0x00007FFCD7D90000-0x00007FFCD7DA0000-memory.dmp

          Filesize

          64KB

        • memory/5944-14-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB

        • memory/5944-26-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB

        • memory/5944-47-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-48-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-50-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-49-0x00007FFCD9DF0000-0x00007FFCD9E00000-memory.dmp

          Filesize

          64KB

        • memory/5944-51-0x00007FFD19D70000-0x00007FFD19F65000-memory.dmp

          Filesize

          2.0MB