Analysis
-
max time kernel
6s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
14/11/2023, 00:47
General
-
Target
HYUNDAI INVITATION LETTER.xls
-
Size
282KB
-
MD5
8ebd7658975d158beeb4587ac66d2628
-
SHA1
b83a388737ab385163ef9ddb715a45d04550f138
-
SHA256
1f9447b936dfc7d9b4ed44796367ade3baa9dec8776e18154b3e45b4cb08bebc
-
SHA512
99fa927495f1604b4a876f85953ff6d5718096705481c5fce7dedc5cffbb5f62b7f5a7228339522876ae34aa3539753b48bf250c2ca6b3e02abe65b321d22ecc
-
SSDEEP
6144:EXRC/eu3YDp7LLFY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVsnMI0zBRBmSg:EX4mw3bVsnMIOfm
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\HYUNDAI INVITATION LETTER.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157KB
MD55271616617ffc1a3b926387e26e42066
SHA1a476741cef2e24cd6c006751b1d751c37a894447
SHA2566aabc3b483b4418b43fce5dfc4f9941925f3ad5519c67ab151090481d7795b23
SHA512063d577c6d2104ecb3b4ed4ec6d99145a018e09e91e8626de7ba7e044dcb225e4a75f94dcf63a23d0450085f9038e25aaf676c36765c71f1feb6309b8dc4a4e6
-
Filesize
2KB
MD5710d71d553bcfc098cb564e0f0fdf981
SHA1f27b362655d8ac42174e6d7bffc8518cdf6dede6
SHA256f0ef17db012516438ee1b5a2b0d2b046c93c528d61bd0c10863e0262a4785170
SHA5127e8489b2760bd1835308a817f84e011076de64e118e970bd85a7b86989424d326fc22960b1f63f785d870aefac1442697f6262a26307d1ea4d26689f4e3ef7a2
-
Filesize
4KB
MD5f7ef55ee2604a84e25bb546c806d252c
SHA108cd4ca823a52ccda3cc5d4c79d1d66deed31bac
SHA256c663aef5b12ede37ace5b448eb54cc3784a640ac030186dea42ea211fba840c7
SHA512e4b28314c1123dc7d6f799555cb4a7ec6f25a0429e1c91177d0c6efed8b9d8a82b3fc3d641ed31c7737cbc21631c01f303a3c957db05523fbb3e562e3ab130ba
-
Filesize
54KB
MD538568025b92f7ae0c0ee7747c8495f97
SHA152917ea86d627d77388ea6e874d80faf37720d1d
SHA25654a662cae6dc5445bfaf070e62fe1aa571d537e59e74aa189313c111c074a7a2
SHA512277d309b2e4ae52eae45c7d56243a38677b80517fd88ad00037efdca166a7982bf661674f7397d0317cc9a3a44e90d068362e5d5ad4265bbe2e17b17ad8e5db8
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB