Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-01-2024 07:56
General
-
Target
PO0124.xls
-
Size
497KB
-
MD5
88018e2dd9271a0c2eaf779c6b788520
-
SHA1
73a87514d24b9a90635badc789727275ff2bf699
-
SHA256
9fe05d334025c4de61b85916e3575acfa5e672b5e689a930e69a7a9050703abf
-
SHA512
9a0408115617883b7d3a029b7c6d7bf934fd556e7ec1ac2ffa80a21bc1c78862d0f127ac3acca865d10f9bf7898d5a4619a591c7bc950f9a46fcbc547ca4868f
-
SSDEEP
12288:PSN9BC6uEkaQpozwjTqCfgfSLMS73tw84Jqmwyz36NQgJv:Aw6sOWWCfgfo3tr4JqmwyzqNlv
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO0124.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD59098d5d38514e2c28e76bf280e00797f
SHA1d329c7ac237ef9827ef0b31b9b3b193a0bb3cb81
SHA256e51bd29231b13269eefef5b0e82590dddf14cb1cb4a07b9bc0f3f7d4a70dcc99
SHA51255124f3536ef54d23f16ef7b966177abcee14d8c31f47527b470b2e705162d080c73327b11a741e907b393821dcc7ae386324f5fed2d4db2f2010adba79e2b93
-
Filesize
2KB
MD5f99699e7644e5cccd881fda48f8a5281
SHA137fd80692c6d5591b2aa5b0f10b05b30937df38a
SHA2568a077f287dfddd31b4ab40de2354a2da3f7250f9f3e972fce20e30d1cb0e5377
SHA51292b4c47dd9bd1bca9261aa005e309eb59d3414978d97a4c24affda02da6b5fc4d3d21330ce1b6185ce94f4cc8da31a43910bb67a338097dabf575099a7771754
-
Filesize
53KB
MD57d0df172cac1c6167dc35d5e02aab044
SHA114d6c8d972e3a5d64a1144c20e2f731ecf0f56af
SHA25667126d1a6a370d554a1360206c20255ad3926425b131d740babb9596793771ed
SHA51269622f734306d6ac23f79d354c5c78bf83a21823e8dcdd9a251cfb2b46b5446f216dd75249d8c57452f78a7a8cc57d4ef2c9b850de180fa6185698a1753fd94e
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB