Analysis
-
max time kernel
111s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
14/06/2023, 20:30
General
-
Target
Pedidos.xlsx
-
Size
726KB
-
MD5
2bb06693c9e1eaf5576f8a503495dcb9
-
SHA1
e29c64134a68b3d58c18491f59c62428cf315930
-
SHA256
d020d147b7c1988c868b9c84f738ce36f4e0d0271db8cc2b3e9d314acb0940f9
-
SHA512
c5b771bd9d2f9ac6b7386e9898db0e105f9245bbdd27ad04c86ef6d3bf3967560432a6e3d2eb334b4c4ccf3ece537934c00b9e9229c996afe619dd92ce31a8a7
-
SSDEEP
12288:TML7nvXmvq+HR5HIrrk1C6+1uNy45XPyTyOE1w4ZUJ2IpQF4Svs+erQxQX2ptOua:6mvqc5HIUT+1qy456Tf6hZgpDrQxXxe
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Pedidos.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB