Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
16-10-2023 12:36
General
-
Target
Specifications/Coverall fabric for sea shore work area.xls
-
Size
126KB
-
MD5
7f75a12e8a7e17791cd6f025c252a95e
-
SHA1
35a884a775451ebb9dbde56b949d62b6a6580da2
-
SHA256
6b13a6db6b10368dc7056d51fb11ebcd5c9daf3d348e115434dcd7938a42bf26
-
SHA512
c955bea1d34621bfe539f17a43a1db33142fb869a2f8ce7643eb7e2625ee9c993dc3e4dcad4e5fbae4d9a38c94d7e9f982093abf938864a1f2ddfaa289ea7807
-
SSDEEP
3072:nIpTVkIpT9uIpTVKCZ+RwPONXoRjDhIcp0fDlaGGx+cL/WEgng2h7:IpTV/pT9xpTVbZ+RwPONXoRjDhIcp0fT
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Specifications\Coverall fabric for sea shore work area.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5247df3295cb4fcac02ef2b372e4b93c3
SHA1dc6ad28629daacfa92c269dc8cd5ff8a3bda164f
SHA2560e4ba38f4e41fffff1b9dc4b4a474c8923d568edc4971d3cbe84366f096acdd4
SHA5126f110cef75a886070b2a3841d53b8d9d64f9e429fbaae7a34c751e2d461b6174739045e52bbc2767a1820e1c0500185e433d31c46115691f51bf274998ee0179
-
Filesize
253B
MD52d9f5a97c8f7b19a4d7ae669f21594c4
SHA11828dafdb80925d2b3923020f4194ccbf4a177de
SHA2561d33b771331da970c4eee40076db878ea6a929f2097f4cf6ab18cb5882bcce16
SHA5123a733e8219159648edf91b3585d328979a7b55883eb412ce5df1d572bc054454b295ebcbdeaec268753a70cd8f65e1bbd68f4832b8aa068dd6c9bc33f146a025
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB