Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-03-2024 03:37

General

  • Target

    b0398e7c21b496f5ffdb4072b8106b33.xls

  • Size

    36KB

  • MD5

    b0398e7c21b496f5ffdb4072b8106b33

  • SHA1

    502212ee9b160926894914a6c415a73850311efa

  • SHA256

    d6c1152b58e9824e2297666f13e67bc0a8cf46dbd57ab7b94957dc8f287c7dc4

  • SHA512

    0689f8fbc592da298b752ca5647ce04b4bf1d1da41f5c58cf753e511224c739e2808683633080de0e4188d9a7a2dec393328bb72140902c110c9b240c59e3cc5

  • SSDEEP

    768:NPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJEgQ57wSYbaVt5:lok3hbdlylKsgqopeJBWhZFGkE+cL2Nz

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b0398e7c21b496f5ffdb4072b8106b33.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Public\Documents\g7d8.vbs
      2⤵
      • Process spawned unexpected child process
      PID:572
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\g7d8.vbs"
      2⤵
        PID:3444
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3476

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\Documents\g7d8.vbs

        Filesize

        599B

        MD5

        3d4cbf23fa7b6fef22fba67b5de9ad2b

        SHA1

        8c5730e67257cc3dac12531d0ce696f07988e557

        SHA256

        53619ec1dbf40c085fa9f3db1138a0b97734bad0166ad73cae6f47538e92bc7a

        SHA512

        70400a6e88a4637b253fd68d21c2f83057088e8160e3201bf23509f0c7f9f1dbe3331546d4d3f6aef807099ac9fedd00d68066a54e5f7ecd9f7746806167146c

      • memory/4016-14-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-42-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-13-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-5-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-4-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmp

        Filesize

        64KB

      • memory/4016-6-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmp

        Filesize

        64KB

      • memory/4016-7-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-8-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-9-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-10-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-11-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-12-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-1-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmp

        Filesize

        64KB

      • memory/4016-3-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmp

        Filesize

        64KB

      • memory/4016-22-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-16-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-17-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-18-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-19-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-20-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-21-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-15-0x00007FF80B8D0000-0x00007FF80B8E0000-memory.dmp

        Filesize

        64KB

      • memory/4016-23-0x00007FF80B8D0000-0x00007FF80B8E0000-memory.dmp

        Filesize

        64KB

      • memory/4016-2-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-40-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-41-0x00007FF84DBB0000-0x00007FF84DDA5000-memory.dmp

        Filesize

        2.0MB

      • memory/4016-0-0x00007FF80DC30000-0x00007FF80DC40000-memory.dmp

        Filesize

        64KB