Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 14:44

General

  • Target

    aec46d8da7a1c5e06d6ceadb8691dbe3.xlsb

  • Size

    116KB

  • MD5

    aec46d8da7a1c5e06d6ceadb8691dbe3

  • SHA1

    477a896c207c3b1ebc866f9862aa481bcf8c001c

  • SHA256

    2b1206d427d4676f608ce841f7e847fd9949ab8457d66a3071e9408321e86434

  • SHA512

    27ec53772b17325e0c2937ed165a5d493ba01cee54d6a5b7b6a94330d7c728ae464b922d10429c3595bd6b355bf1309242182d8b5821b9b8eb08861c7807525a

  • SSDEEP

    3072:oUanAhD3TysKYZM8i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3/:oDAh3PKYo67Moaaaaaaaaaaaaaaaaaal

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\aec46d8da7a1c5e06d6ceadb8691dbe3.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Windows\System32\Wbem\wmic.exe
      wmic process call create 'mshta C:\ProgramData\YKCdakNtTmr.sct'
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of AdjustPrivilegeToken
      PID:2328
  • C:\Windows\system32\mshta.exe
    mshta C:\ProgramData\YKCdakNtTmr.sct
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    PID:464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\YKCdakNtTmr.sct

    Filesize

    14KB

    MD5

    ddce19b9903f579aa00f77b4b3676ac3

    SHA1

    c47755e7a82979aa272f0b7b5de4cb4ab12e72a7

    SHA256

    8880191127574faf1694bd8619faabde8ffdf1e961f86f5002d6797fe376d1e3

    SHA512

    40b186ff3157ed33532d970377be1ad78c996ee1f120f7ab304f96e6afbfcd4b863e9d982932f061d244305986eb417fe08f7a0d03e122d333f421d72dc0a958

  • memory/4964-16-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-10-0x00007FFB2B3B0000-0x00007FFB2B3C0000-memory.dmp

    Filesize

    64KB

  • memory/4964-2-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/4964-4-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-17-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-7-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/4964-8-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-18-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-11-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-19-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-9-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-6-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-13-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-15-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-14-0x00007FFB2B3B0000-0x00007FFB2B3C0000-memory.dmp

    Filesize

    64KB

  • memory/4964-0-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/4964-5-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/4964-3-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-12-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-20-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-21-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-22-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-1-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/4964-39-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-40-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-41-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-57-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/4964-58-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/4964-60-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-59-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB

  • memory/4964-62-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-63-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-64-0x00007FFB6D390000-0x00007FFB6D585000-memory.dmp

    Filesize

    2.0MB

  • memory/4964-61-0x00007FFB2D410000-0x00007FFB2D420000-memory.dmp

    Filesize

    64KB