Analysis

  • max time kernel
    109s
  • max time network
    215s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 12:06

General

  • Target

    TvcomFreight/Opinion.xls

  • Size

    68KB

  • MD5

    2b5fcb3cd72546ec42e467574044d822

  • SHA1

    253ba53ed24d55c422e38f5bd66ff4448de08c93

  • SHA256

    ddfd3dc555d81c08940e0632d7ad5c21891999d4e005361069f8a2beacfd3228

  • SHA512

    79d2ffdb33766b62201ee356d5b4ebcdbad9587a2bcc5e33c3dd258fad5a54aaf509668a324a4789ebb6bad0e4a131eebf8822561f2d3a52a4afb9ce9b549e59

  • SSDEEP

    1536:v2kPXhF/3aUKqwsmjJXJplfjJGHvSBaM2D56ZRiu8PtAYNufZrOWuG9:v2uxh3nKqwsQfjJGH7M2DAPnqSrOWu8

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TvcomFreight\Opinion.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3340

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

          Filesize

          2KB

          MD5

          0991107a261c046c2f26ba2db340500c

          SHA1

          aaee9e5bd64497ca769ee74f92246c3c6c6c231b

          SHA256

          207d1d79db5dc0d29a5053422b0c188d9d80f75b1341aa3f06d9762ebf1d3b64

          SHA512

          05c0d862066c1ca1dfddd5dc1f767a64bdbc02bfbbd91d313835377a5692afe7bd1e2adc6deecbc49534579108ce39bfd2d4d6504e75b38bcbcaaa8cdbf3744a

        • memory/3340-6-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-15-0x00007FFBF9080000-0x00007FFBF9090000-memory.dmp

          Filesize

          64KB

        • memory/3340-2-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-4-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-9-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-10-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-8-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-11-0x00007FFBF9080000-0x00007FFBF9090000-memory.dmp

          Filesize

          64KB

        • memory/3340-7-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-13-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-3-0x00007FFC3B20D000-0x00007FFC3B20E000-memory.dmp

          Filesize

          4KB

        • memory/3340-14-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-0-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-12-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-5-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-25-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB

        • memory/3340-1-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-49-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-50-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-51-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-52-0x00007FFBFB1F0000-0x00007FFBFB200000-memory.dmp

          Filesize

          64KB

        • memory/3340-53-0x00007FFC3B170000-0x00007FFC3B365000-memory.dmp

          Filesize

          2.0MB