Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 16:31

General

  • Target

    NEAS.1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757cxls_JC.xls

  • Size

    1.5MB

  • MD5

    71368866925c23e35d340705fae95002

  • SHA1

    8b2e76a61f33f053eb4fc2f2bc3600917e7d1d09

  • SHA256

    1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757c

  • SHA512

    6bddbc8a6824bf2d7137042b762da78d8c02e6756f488003a8d142cc7b111720710f4f31034e8d9c1dca33847ac822a9ed81d2e97f647d0708ddb5db271461f6

  • SSDEEP

    24576:cWQmmav30xrmZy3w6VA3bVNRFZyVw6VC3bVG4nvsLtbtecTQ5WWkK3q/0wkex:xQmmQ309wP6VA3bVDN6VC3bV25tBTTKg

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\NEAS.1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757cxls_JC.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3728

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A7D7B60D.emf

          Filesize

          1.4MB

          MD5

          d69c22a341e111feea69df6d8c655d60

          SHA1

          ac862337f2efa43627508927f5052ce694012206

          SHA256

          05b2053bf1d070d6034b45cd79b54d80da3c6d88d016671a345e75048b1a68db

          SHA512

          d4db33ed046b3c9ba09c4b3feac17b1fe2e75fce67f4154fd795d504708c295a1e3c8331ed3d6c3ee9950c936c4cc25b5d690558c26f2e1f7771bd5eb275822c

        • memory/3728-15-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-19-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-4-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-5-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-1-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-6-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-7-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-8-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-9-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-10-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-11-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-12-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-13-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-0-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-3-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-17-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-14-0x00007FF82E550000-0x00007FF82E560000-memory.dmp

          Filesize

          64KB

        • memory/3728-18-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-20-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-16-0x00007FF82E550000-0x00007FF82E560000-memory.dmp

          Filesize

          64KB

        • memory/3728-30-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-2-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-67-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-68-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-69-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-71-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-70-0x00007FF830EB0000-0x00007FF830EC0000-memory.dmp

          Filesize

          64KB

        • memory/3728-72-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB

        • memory/3728-73-0x00007FF870E30000-0x00007FF871025000-memory.dmp

          Filesize

          2.0MB