2678ea9a98659545592b7982a17a1b65b92f0fba7eea9d15760f2dbcb7546956

Analysis

max time kernel
100s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2023 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation.xls
Size

1.2MB
MD5

12c87026c144f87df2338e40f2293b19
SHA1

b8caf6a6c738f7050523381c4e7fcbba08ec6433
SHA256

2678ea9a98659545592b7982a17a1b65b92f0fba7eea9d15760f2dbcb7546956
SHA512

b7ea848f6140b81ca8f1a7d9b8f6f6710f709f5289a3bfe707de04416b8b155b6d3afcd3c7d8ce7774903842bbd94a112481d9a3e8bd83b17b1e7616ae2e288c
SSDEEP

24576:QLKrBwtHlx7WQmmav30xJB48tHlxGWQmmav30xF6FIW60z0tUo4QcZRx:QLKro7aQmmQ30D2S77QmmQ30H6Q+Qif

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4300 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

4300 EXCEL.EXE
4300 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE
4300	EXCEL.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Quotation.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\60389C1D.emf
Filesize
577KB

MD5
c754c0c24e79a52d15d601b962cf610c

SHA1
61939f164242c509360fd18fcc32474aa6d8ec29

SHA256
36e82aa3352a6c2b7b36bc8b16ba84addd441adc8c69fb1c900300406a1d1739

SHA512
05c78a58a4230cdf5545a0e61376740bbd25f0fe9ec6a78059043804d31b565e6af1c4236f1f8fbbd50929c6acc515692c0f979046b526308a14988af2ffaae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AFE87B7A.emf
Filesize
34KB

MD5
d07b4beb4ff3f1a5ec31e2eebe944e91

SHA1
5bdcab90d8b5d983d6db791b28861d536e680c74

SHA256
37efd4401bfe0a063b3585dca0753ca49dced57862a3f58558eced424c557bee

SHA512
11a1375a7c5d5924d82f845afa77b36e960ee1730d13fb7a337d28a4dd142a61a7a1f095d1039285f92fe420077cd717e1ffbdceccbd300a6fdf1085facee2a2

Download Submit
memory/4300-139-0x00007FF9A6360000-0x00007FF9A6370000-memory.dmp

Filesize
64KB

Download
memory/4300-136-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download
memory/4300-137-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download
memory/4300-138-0x00007FF9A6360000-0x00007FF9A6370000-memory.dmp

Filesize
64KB

Download
memory/4300-133-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download
memory/4300-135-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download
memory/4300-134-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download
memory/4300-188-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download
memory/4300-189-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download
memory/4300-190-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download
memory/4300-191-0x00007FF9A8790000-0x00007FF9A87A0000-memory.dmp

Filesize
64KB

Download