Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11-12-2023 15:14
General
-
Target
PO-0075930-1.xls
-
Size
1.1MB
-
MD5
c677f23b98f41ace3e30b3451a29e865
-
SHA1
c04789e8a9edea9ad9b8694bbc471460ce3d2e8f
-
SHA256
46cc5500d9579887c1d2694b124d18f2915c0e372bd725aa57a4eb610e02a75a
-
SHA512
fc2bb50269d62a5d31b82dbbbfbdef9164bbdd14f4406e82ba3238e338a9c306ca1aede8c8e81e0bfb23bd861c2a965ce1e926712d9919bb7f09d36ce0a223b1
-
SSDEEP
24576:Bw6/4ZyEAXZS8sw6/mZyGAXZSZiGwwcqZUovtJfTJqdLQ33powDXH:66/qKEE6/wEE+CjvjdMLQ33pokX
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO-0075930-1.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5f153b9705422f1c5645f1346e0307c7d
SHA147d18a265920a1c9c7f2a277425ccc41dff02edd
SHA2562d6ccad6b7271eee2b1d0cb8d98769d09b2c66a51690ce36b698275535f619f5
SHA5128fc78c4669492ef63b263da1d6c1a933b654232b968a688ef0e3f117ff04de3e0b72574f1e664050df38c8156dda184805a8fece18059e9bc032a63e7c813ba4
-
Filesize
146KB
MD5b9f8a38a1e57efaae1b700cea34396d9
SHA1d7808c1e8a7e2347bc882a61b082adc3576b5d2a
SHA256f767c5feb87024364c2bb42dbea3c29ee00ef89d9b2cf8fc57bdfcb57519defb
SHA5122a270106852548163517afb890fac5e8675a3c7c10e71135968d8deb3dd683f6c241244173d3f834cef897cc9dbe6b030302480ddc807bef92880b20b1f41055
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB