Analysis
-
max time kernel
168s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
06-10-2023 14:18
General
-
Target
7030200100.xls
-
Size
1.0MB
-
MD5
db838e896fe65e782fde6004f549d93d
-
SHA1
934e383c200be732053ff5eb47bbd815c3ca2576
-
SHA256
9b25f1b5b77466f9bd0e8b3f69cf5b5ec10dd5691a59767e5d8ae34f226a4a7f
-
SHA512
3f27b47b710237ec605d4fa85f2067749e58e86f414cb41457fc4121a81c82905d53fa9575578c60a51099e11412aba918aebd033ae75e137d369a8c2552c332
-
SSDEEP
24576:PX8DK69PFoheP1QPHwLFRkLFR8/fFX0wv4knkL9kmJZODqcx2X:4L9Nohy1QP4K+4kkLCd
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7030200100.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5fcc22d9a2d21aec5faeb744365c850eb
SHA1d8b632126c1cbd751d20c3ba0dacb6551daa8257
SHA25677bdd8c7a012ef67403791d674f0e7923bff83a78a82f1d26857718e5a4b4b24
SHA512670c9d4c6a3677b952915d64f8a5e313862f6da13fc39cbd93e4f86d44c0b911bd2a2b92e6d3386168b05d70b6c5b8bc090323c190b2d1af020227963d2ba1f4
-
Filesize
26KB
MD5432af76c6e1aaf2f1848808a1ccb3f8b
SHA1e17341ee87423994c5643c0ae8215a40913110e2
SHA2566084216cf7ff4dbdf9047a82c60170eb8d09dc6003469dbf5c98465ca640f5f9
SHA512332055234d95f36acf4d6d99c0266ecb6d5381b485c7b1a3c51be7840fd8078d27ac8387a466ce52edd78c6f0ef61f37cf90514187ab0bf664068bbdc8fcb77a
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB