Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
02/10/2023, 15:28
General
-
Target
Ord.For.NGF2301820.xls
-
Size
146KB
-
MD5
3c80a3404a12b03596de173b7c2395d8
-
SHA1
0f2747a0d918456486c729f6f47f41b1523c7ff0
-
SHA256
c36edbf6ff6981ab06c2bebafef7340da2c28565751b4e1e6bedb4cd02f992b4
-
SHA512
94e9da4e191f0282046cd7430b4588534fc0006288f0ba1dbcafb2dae6058d79c95987d8b303daa9c07b487d01329b7e9202b3502bf0e399857bbe67fa8389b9
-
SSDEEP
3072:F/kJAg15QiSCz0Huru1bsNTL3SupLsld9kgYUWo:F/unQKAOHFpLKdJ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Ord.For.NGF2301820.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5b5b37a09dad646fcff110f43aa8b38c1
SHA1e8c5d19591105687646736be2e9b7eaae5920441
SHA25662104d5bbddd0635231b298c44e2bb141359382314a4e4bbc27b69304a5ec0aa
SHA51210c16bb1aee0bcd3dbbbe4866450823a5262cedde738b3bb2a117ba7f77a64b6a036edce4fc19d34dd816dcde13cff9471b39b2ea1f21b79d754605c38513f2b
-
Filesize
22KB
MD5c525805107dafbab4307168b2544d08c
SHA12514a0564bbc807fa2c4f8783232c63d39f9dc1a
SHA256e5c0df7eb4648577abe7401b2d640479e9736e1a5d389387b92a694e4234c0d7
SHA512f42fbb17099e0541075601f8443d96469c1fe9de28cdb6c5f9cfd7151d507dad7a3ced3dc4a13bd195aee9e3f097506cdc1a8ed43b38801c57c39a99993e3a0f
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB