Resubmissions
30/03/2024, 16:07
240330-tk28laab25830/03/2024, 16:00
240330-tfrw3ahc9y827/03/2024, 13:27
240327-qqkc7agc2v827/03/2024, 13:24
240327-qnfl8agb51827/03/2024, 13:22
240327-ql79fsda258Analysis
- max time kernel
642s - max time network
629s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
30/03/2024, 16:07
General
- Target VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.vbs
- Size 35KB
- Sample240330-tk28laab25
- SHA256 ce21d34bafe338effb8f619936f057084cb45743fce884a1465966d8523a00a8
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 27 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.vbs"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Excel.CampaignStates.json
Excel.GovernedChannelStates.json
Excel.Settings.json
Excel.SurveyHistoryStats.json
5A0A7AF0-5F7E-4740-91DB-5699D67B173C
excel.exe_Rules.xml
excel.exe.db
excel.exe.db
74a0ad00a184813f0b8867eb2f8dfef7227a18a4.tbres
memory/428-229-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-226-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-239-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-237-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-244-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-235-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-234-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-233-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-245-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-247-0x00007FFF5F8C0000-0x00007FFF5F96E000-memory.dmp
memory/428-230-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-249-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-228-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-242-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-225-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-431-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-432-0x00007FFF5F8C0000-0x00007FFF5F96E000-memory.dmp
memory/428-394-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-257-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-263-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-253-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-255-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-251-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-220-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-221-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-223-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/428-224-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-447-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-440-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-442-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-443-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-444-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-445-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-439-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-448-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-449-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-457-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-459-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-450-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/688-461-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-210-0x00007FFF218F0000-0x00007FFF21900000-memory.dmp
memory/4956-12-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-11-0x00007FFF1DF30000-0x00007FFF1DF40000-memory.dmp
memory/4956-13-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-0-0x00007FFF218F0000-0x00007FFF21900000-memory.dmp
memory/4956-211-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-213-0x00007FFF5F8C0000-0x00007FFF5F96E000-memory.dmp
memory/4956-212-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-10-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-14-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-9-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-7-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-209-0x00007FFF218F0000-0x00007FFF21900000-memory.dmp
memory/4956-5-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-3-0x00007FFF218F0000-0x00007FFF21900000-memory.dmp
memory/4956-4-0x00007FFF218F0000-0x00007FFF21900000-memory.dmp
memory/4956-1-0x00007FFF218F0000-0x00007FFF21900000-memory.dmp
memory/4956-208-0x00007FFF218F0000-0x00007FFF21900000-memory.dmp
memory/4956-207-0x00007FFF218F0000-0x00007FFF21900000-memory.dmp
memory/4956-199-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-171-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-26-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-25-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-24-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-23-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-18-0x00007FFF1DF30000-0x00007FFF1DF40000-memory.dmp
memory/4956-22-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-21-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-20-0x00007FFF5F8C0000-0x00007FFF5F96E000-memory.dmp
memory/4956-19-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-17-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-16-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-15-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp
memory/4956-2-0x00007FFF61860000-0x00007FFF61A3B000-memory.dmp