Analysis

  • max time kernel
    138s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2024 06:54

General

  • Target

    1.xla.xls

  • Size

    49KB

  • MD5

    1620224d6efdc7d009b64899a6a67626

  • SHA1

    aa99049bcb8caaac23c7c3a9488b47435ce524ec

  • SHA256

    d1836e6e0661938656d0d8883daa624f59b4a0885cd663be712bfa88a5ccea19

  • SHA512

    88720b9050af39543b21ca51f4771b7b9afecbc7db697fb0116208d2ea18ea290d6b6304ced66d8d602b07cf13664fd4715b0816bd0d93a352c69a275d6600a5

  • SSDEEP

    768:fXyBP0IZ3ovboGfJlETRro0LPpeTQMjpHJDQ/QxLEC65:fX68OPwUTRrnp2hjFJDREC

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1.xla.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:400
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4324
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:1756

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D0A696EC-E466-4BE1-8998-DDA71B1B1773

        Filesize

        160KB

        MD5

        2a1657672444801717f9e6d606f8380c

        SHA1

        3efa2e766410b872800d2efe4a5bdf7b1570cdf9

        SHA256

        4d76f400a6ebc80e278f144df04b12f101de68cf1283e679850894833c096ec2

        SHA512

        df318e59a310c429ee60b72541845af71819f184a873ae8766d0995eff33eb5da8dff7503194534fc9dbc5a255a1da19a4b1f4087802edd5b381ae55fc064523

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

        Filesize

        2KB

        MD5

        a9889c14f23ba629f87451d76e790bdc

        SHA1

        c53da732eac2653b545325ade55e4c00c54a398d

        SHA256

        ec9fca01e9364621d99fa72745922503b7e3291b2599dc0aacce2ffbb29586c6

        SHA512

        012239098a1dc2fc7f59a88a4cb1900eaea9cc984bf886c62356074291670fba03ce6e410386928f1dc239d4bfa4c8827dfd33e49b70833f679d0f69ae3afba1

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

        Filesize

        2KB

        MD5

        1fe4f9176a0886a997cc0b6e7aa0731d

        SHA1

        2923b865953347ae95c3ba52a95f91972bf74952

        SHA256

        c1f5efcd445ce07b08b298558cff307bf3d314cf2e305b6b5857d6305d6b89e0

        SHA512

        171efd2bd4d30e876522f69b8add42894caac5ecd440a8e6af7265a319c86cc27559333ffca1c43b3d7a870ba7dd483b78985f4ea3e4a2907eaccc300c5964ea

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2ZG7H8ZF\heisagirlwholovedmealotwithoutanyexptationssheisreallyagoodgirlshemybabydear_____itrulylovedherfromthehearbecauseverycutebayb[1].doc

        Filesize

        72KB

        MD5

        1b64a140f23bd235c3c482429cb05065

        SHA1

        141c5ad46db205b08032c22292bef782007fa771

        SHA256

        87394948b0df5b356230dcef42c97b38b2cfa29df166f9cc820b0ff440f491f2

        SHA512

        c9a3cfa93b6edf9644e8eeb2b8f17a6be704d9256c922e3a558e71d82ed752ed3eb9eda4a5739d60712af891929b989a2600151e3ba1e7cde7eaac74cc891b30

      • memory/400-18-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-19-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-7-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-8-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-6-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-9-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-10-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-11-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-13-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-12-0x00007FFD30D30000-0x00007FFD30D40000-memory.dmp

        Filesize

        64KB

      • memory/400-14-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-15-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-16-0x00007FFD30D30000-0x00007FFD30D40000-memory.dmp

        Filesize

        64KB

      • memory/400-17-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-3-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-5-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-20-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-21-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-22-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-23-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-127-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-126-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-0-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-125-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-124-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-123-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-122-0x00007FFD33590000-0x00007FFD335A0000-memory.dmp

        Filesize

        64KB

      • memory/400-83-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-82-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-4-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-2-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/400-1-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-43-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-57-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-60-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-56-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-61-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-55-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-54-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-52-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-51-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-50-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-84-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-49-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-48-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-47-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-45-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-42-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-39-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB

      • memory/2352-135-0x00007FFD73510000-0x00007FFD73705000-memory.dmp

        Filesize

        2.0MB