Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-03-2024 01:36

General

  • Target

    3e71b3d85e286dca892374bc71698ceb5a58762e0dc6876fe1dc994ab11c31f7.xls

  • Size

    317KB

  • MD5

    fb5c7d14e1ec93e569a9fb56c7282d22

  • SHA1

    58d681fdc19e4509fbbc91ab4c3d28d61c4daa6e

  • SHA256

    3e71b3d85e286dca892374bc71698ceb5a58762e0dc6876fe1dc994ab11c31f7

  • SHA512

    a014557ecb3d08d5f88510dd9fb27401985cca9e9292062489b85fa43610587ffbba59bdcfc4058a8c8e713662bbf90faca7c905a0c5fc7142d33a3eb031827e

  • SSDEEP

    6144:VqunJ2VY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVk0MIv3ZkBbqBYMzcswEq:VbJ2c3bVk0MIgiTzcUqe/nWYaLDs

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3e71b3d85e286dca892374bc71698ceb5a58762e0dc6876fe1dc994ab11c31f7.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:452
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:408
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:1408

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C3CB79BE-4857-4D62-A07F-26BA6FFE7F9D

        Filesize

        160KB

        MD5

        3a6451b25f52586e1b7cb1656a4f185a

        SHA1

        5fc3605b9c494d4b396b09cf8264939bf2618d17

        SHA256

        4503e6dcb5a8341d0fd3ce8985da263006d15d32f4b9fe052bba7d941b644011

        SHA512

        c1bb454ea1b32c0f5da68c8d21092f57d5200c4c729f62d4eddbd174f53e4dc24927241b3023241b18b5a75acd4acca5a44eab56177e6fd24f43289723fdad92

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

        Filesize

        2KB

        MD5

        e412aa5af1298262dba336ef9c734298

        SHA1

        f14d20b1178c095b76d6f0ef95681a1770a79395

        SHA256

        f20b4944c890735fad7f7adc913ab7d592b27fbf83418698c764156736c2b0f3

        SHA512

        710f97052b51430af3c78eea11198148e15602154de68e8eae36f9807a0a1cc00af7d680d31ef79cb22ba41850a3a9d8f5f64d63342e1d964f7f99b0f8103f59

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

        Filesize

        2KB

        MD5

        ec506e3c4acce5f25803db2f7929ac39

        SHA1

        f696099243328eefe03822fad83d910c63f7e98f

        SHA256

        f052517b2deb204df574f22a5fd19731b4917b5a36568a1cda22b98cf246a7db

        SHA512

        01cbc492b782162348a7c2d8627d4299876a9b05776eea03097f80c87f95b9ddad93e3303ad337471ccf56e987c4249b5d39259f09a55dc2a0dc8f8bbbd50de7

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\iamdifferentfromothersandlovingyoutrulyfromtheheartwithoutfake____iloveyouiloveyousoomuchwithallmyhearttogetu[1].doc

        Filesize

        70KB

        MD5

        4f0f6cd3d79ef0d367bdba2aa80554c2

        SHA1

        cd023c49119fb7a6edf2cd4eae824f5ac0a0f6c6

        SHA256

        63056ca0409d5e15d038ec044aa4fccf4ddddbeb17ee697274feae60fb520f0b

        SHA512

        cd4e15e949565888e37a4b9df8350950f2aa9f1f3564e1564eb2bb4afd54b25a4415d08127002cdd7843f79e1b67fe7b6f16f00910fe2e6e801b6a5e6f4171c3

      • memory/452-20-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-78-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-6-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-7-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

        Filesize

        64KB

      • memory/452-8-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-11-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-12-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-10-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-1-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

        Filesize

        64KB

      • memory/452-13-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-14-0x00007FFE9FC50000-0x00007FFE9FC60000-memory.dmp

        Filesize

        64KB

      • memory/452-15-0x00007FFE9FC50000-0x00007FFE9FC60000-memory.dmp

        Filesize

        64KB

      • memory/452-16-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-17-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-18-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-19-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-0-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

        Filesize

        64KB

      • memory/452-2-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

        Filesize

        64KB

      • memory/452-9-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-4-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

        Filesize

        64KB

      • memory/452-5-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/452-3-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-45-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-58-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-50-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-57-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-47-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-54-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-55-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-49-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-52-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-53-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-46-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-51-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-41-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-43-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-44-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB

      • memory/1344-79-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

        Filesize

        2.0MB