Analysis

  • max time kernel
    102s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 10:40

General

  • Target

    Documentos de env�o DHL_987654236475869776875465423422343232345341134.xls

  • Size

    30KB

  • MD5

    40e068be98ea0b6ca31af370328840b6

  • SHA1

    11e7096e6268536aa7e80e6f87c0c7815b067566

  • SHA256

    d7ae9c118c01c6751d64e011c70f601a73cb566df9ab3d43d25e69e30a5d8e4a

  • SHA512

    d7f114e8a91535e98a2ff1c492879ccb9b4979e9cfcfaab612cc80bb88c80f55f15bbc0dfc080175f509dd282c43712b60990dd1eed9cac84d0c4e5283f5a8a9

  • SSDEEP

    768:grYJUWXzyicoPdTeSGoqfSE8yCFDKPcM6c:grYhX2NATeSlzJqcM

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Documentos de env�o DHL_987654236475869776875465423422343232345341134.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1664
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:456
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:1472

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C12FAD09-E706-4D09-A885-FAC48D753448

        Filesize

        160KB

        MD5

        5939a2305e54c886bb9fb2ea8c067fa5

        SHA1

        4d4e34b2c4030114766e765995c1890894fecfae

        SHA256

        94c962644608f7b0ff2740d8da072a8d70d23aaeb60b7891d700fd0ed0e49750

        SHA512

        686a491fd33b63522f1c83c9c5bd53d7cec45cb878008edf8765422152eb3d3e23dd56a42bee12497427153cf45247716f965a52248bb3312b671f98907aacac

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

        Filesize

        2KB

        MD5

        4ed85476715af1ddaf3098ee50f584c7

        SHA1

        0fec1d985dae6ed93c7c5e6230f66d06d5b19169

        SHA256

        682fde8ce0a078e12e67fd31b4bb10eecf94bdfe37e2867431fc6dbcb03ed781

        SHA512

        0ef28c1256ce0b384e79d44f8e09f6be3c379a3298ea8be1c5864de9f381bb9fb9eb8e718fc6cc233823347151b517619dec2fac1be3dcdf44ab4922b78a0fbe

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

        Filesize

        2KB

        MD5

        cc91e1a600efa5fb637281c9149fc83b

        SHA1

        f4684be8860c2839d0a5057fdbcefed14181b58b

        SHA256

        e2f44439a43cf7193cdd14810bf60b5bb5de608d7c96e7aa96d129529d08cc56

        SHA512

        6c7c2f415181aa0909602dec382b4955843262f59bd17881db5900d9c4614cf18fcb1be6311789589c1e8f32ae69d3a922ca90cf607e10631eae5060128921fc

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1YRVVION\mrngunlockurpurelovetounderstandhowimportanitsitogetreadyforlovetogetgreatlovertogetgreatlover[1].doc

        Filesize

        69KB

        MD5

        90454adfffe4a15a04a97ad173fd2ca3

        SHA1

        91b00307970f914356907c4e9655e68efa6515fb

        SHA256

        82e52b61e68ba6d8644476c6b23061b528053aa8a8d1f9fd85979a77f02e7edd

        SHA512

        28dde52c89e79c52ce5a03a582aa537126e2e57d26622f977356eac9533a14e37e4943b845ae68e2393267e66a3a3ce81873ecabe4ee6994974997a15b87d6e8

      • memory/1664-22-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-7-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-6-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/1664-117-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-8-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/1664-9-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-10-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-11-0x00007FFE09770000-0x00007FFE09780000-memory.dmp

        Filesize

        64KB

      • memory/1664-12-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-13-0x00007FFE09770000-0x00007FFE09780000-memory.dmp

        Filesize

        64KB

      • memory/1664-14-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-15-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-16-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-17-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-18-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-68-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-20-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-21-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-0-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/1664-67-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-1-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-5-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-19-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-2-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/1664-3-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/1664-4-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/3516-47-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-45-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-46-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-50-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-49-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-44-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-43-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-69-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-42-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-35-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-40-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-105-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/3516-106-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/3516-107-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/3516-108-0x00007FFE0B7D0000-0x00007FFE0B7E0000-memory.dmp

        Filesize

        64KB

      • memory/3516-38-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB

      • memory/3516-109-0x00007FFE4B750000-0x00007FFE4B945000-memory.dmp

        Filesize

        2.0MB