Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
21/11/2023, 14:10
General
-
Target
21112023_2210_21112023_HSBC Payment Information.xls
-
Size
1.1MB
-
MD5
2059752a372d5e3ac4893cf85d6b8079
-
SHA1
264e2ff34bb6cd54f31a3de23f9d9cd8f0b20224
-
SHA256
131a501ed29c2546575209cbaa6837c0dd4d81f9705d3193864d549c10fcddb0
-
SHA512
0ad466cc8faba2c8d625fcb860ea976d20918af6d06e88d021cf12a0b0731becdb6b55660fa18f7431c08a3e30322a3f7beac1fb71c41fb1ec976e3123681eb5
-
SSDEEP
24576:BOBbw6/L3bVDyRAt6w6/FsOM3bVODAmJDrkDwyfQuf5EdFwDox:h6/L3bV+RAr6/Wb3bVOM8Drkd4uxmj
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\21112023_2210_21112023_HSBC Payment Information.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5d0ea57f2b8b3922ca481d0a55cd87529
SHA1db115fc7a7207bdf762de2e68c0a9947f403efb4
SHA256ff725305f629e8a7b0bfced62cfb21b6ecbff93d04d8cbe909ea59f585db8f04
SHA512b67a49775484c51516237516bc48c7138116a0384233f63ec17738734556184d3624112005f5d86ef3ba7b81f897c0781d42473e6632d2ec30fce847493c3af4
-
Filesize
1.4MB
MD51d52e5e624bb040cbef676cde84f3e72
SHA16bfd45326a4b16abaa2394470feb66c05f8918c3
SHA25660f5a80466a2048fcaf489bce42ef0e9e157152a9d3449434871dfcc883f3b14
SHA5123b6da0084094b75f7b21914096e0d9ed11b7caa9fc509610c72b1339629088031009e52dbd806acc9d5dcbd91a238f53305d4bc6422dfda7ddbb9a28031823bd
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB