Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
03-05-2024 10:24
General
-
Target
45e1a55069c41ee818bd2d8f8692d05109d85e6d0616a452b1d4acc2a559a1ea.xls
-
Size
241KB
-
MD5
51c5c3a311d9f0e9f2bf6cc69fe4e757
-
SHA1
0da4417db449a5e59cedd20f4c9e9b63680db8b3
-
SHA256
45e1a55069c41ee818bd2d8f8692d05109d85e6d0616a452b1d4acc2a559a1ea
-
SHA512
0fc0882e35ee2c1f37ac86d7e33f776d0a51ba8ffe65f4d6d76a097e52601923a22b3848d4c7666a4988704a347ba9481c0d04994d332b3a89e439268ecc9edf
-
SSDEEP
6144:qd4UcLe0JOqPQZR8MDdATCR3tSv0W8HrzFPA3RNcr4arH:NUP/qPQZR8MxAm/S8W8LzFP+RNWNj
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\45e1a55069c41ee818bd2d8f8692d05109d85e6d0616a452b1d4acc2a559a1ea.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717B
MD5822467b728b7a66b081c91795373789a
SHA1d8f2f02e1eef62485a9feffd59ce837511749865
SHA256af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
-
Filesize
471B
MD5601546482f46c71cdab6b331340e0e55
SHA1df582e6cb8d3de63ee31212b85bfc14b28bf1998
SHA256521c23da9919eb446c563f602744242a920b02ffcb3fa2f51b90ff389e565eb4
SHA51255a268e3aa117270d74f6670ca87abc5c55c72b92913097b60b21509195f5a8fead2789d659bfe1fe336c777aba2cd4758e75860a61c751315143052948ab077
-
Filesize
192B
MD5a7c5e22198330e0d2ec66c88563424a4
SHA11e865981d450512b07a36eace0cae38021196951
SHA256c3c3d8a20e971892f7e28abd3bc72b7d6d73c126a6a3c7f35dbcfd5440bffb0d
SHA512be99d7aaae4ab2bedd78668b53ec373fd4d6722e7e61f9e75ced5c780b842d47bba7a8f9b50c95f8e0e4d2cc06e44fd529e5de652bb59f8ccc0bb88c3329a5a3
-
Filesize
412B
MD510e01dccf56bba95552d67d6c45d2723
SHA10e8cf5f0d541e474f04d6e8b5cd0ff3ce6620587
SHA2565422463f872368dfecfe9051dbbfb64ea3ead0cebec6eae1c30a833028cbdc36
SHA5123ead3c81b260bccd2be609529d997edcb7bb63c57086b56a1f0847040321382d2d085bdf3a77f451558f27c1d64d154534c047b113dd9de539342b480ab7ba29
-
Filesize
160KB
MD57e91dd3bfaa0eaef1c16e35db31a863c
SHA19bbc1896b8a9f0d05803f17c340fbe7483ee2df3
SHA256fd92ea3ae0bfec69510997a0685e76f3f4a1ad89429bd7d07fc45856358533c8
SHA5123f4393da716b4928057b6d0ec270bfd7284eb94d6846144b87144c3c9b3b5262518f010b621c6093d1239d6375145da0e1bfce65c9e928ddcd7a2c80825cfb25
-
Filesize
21KB
MD5e11339406b93eafacaa803393b664eed
SHA174fd8f40a8904aab761925e250342a39a165c93e
SHA256936018728e47a4d6eff1a1ad6961b2424537b1f75ccaff1684fbd373d42162b0
SHA512681facfb3164d9827a406b791867a8fd45f919537002788ecafbf945f0cbaf935de95d7828efdbb5e65393661eb541dd5bfcbd1de8550f4ad789c182c2c2f5d1
-
Filesize
2KB
MD5b196eef16bc8fd7f71db5f4fffebe2d0
SHA170e8c0327e5222245047443fafb89f4cf5813fdf
SHA2566e5e50f1d5c623eddbe7f1d8f06cc7506b6b8e62bf0f42364c2721e30d487145
SHA5120f2e404809530367e6a004c6943f0a994904b4517b02195f11e17143648b4e31c6c566491d9423f74d016385a0621215ded280cd4adc596d77824d45c7efad96
-
Filesize
2KB
MD50a66a5f7b7609f05e1e2bde831638511
SHA17b0f612e9dc3274361957cbf678793926a04b729
SHA25634190b488c4ae45c74733c9a3f2cb3e05a31a1192ce854814c9c033a11806ff9
SHA51268b1043722ac74cddd146b8a2cb7a13ac00d8936286560b7cec9f025b186e7d7596ec1ceae8ccb97778bfdf6684c651e10088253ce82ea0ec45d79f1cf406abe
-
Filesize
79KB
MD539579fba8fb7611900ac896d4b298140
SHA1b5e7e63b7bb8fe8912f51d293abdabbc988ccc4b
SHA25697bfc85dd5d34c914685fcc9c544b815f257400512a25e7b3b0074845c900acc
SHA5126bdfef986eacccc6be1bec479963bc7e35f56d696847f27e8f752ad4a322ce795b91c02bd1b92fc320cb0df358c9031094582bffc831afe5155c0f0c883f47ea
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
232B
MD5809e53f2fbcb09f6d44acc530c226e03
SHA1e23eca99de9c6cd45daf998a6903eba2b901f43d
SHA25649d92d96f26e36fa7972a57d83d57893a854d9787fac9bcb9e33e55865a6fbbe
SHA5123e1caef34191077e2f98ba4f209dc81038c532ba791e31c3cf941278d3722a6865f3182f0850d4ebb01ea2613ea3c37dfff02da4819a08b0fe6893a1d6ffa217
-
Filesize
5KB
MD5a65f947e2fa84741ccad74eeaa1a6190
SHA148926a8b09c3376d9338a4b9f3371db0a7712dfe
SHA256a9de6ed7591a8f4baba32d85be69a958d9a787858667dd354f0254ccfb3d6a74
SHA5126b90f3a692ff40fb60a7845c98ce3a0754c2d8f82b95c65f3025b142277669d2c3704e9590e57078a7385ec47e83c7a3fe7d7fcde76e53a8d65eef71311ac2b3
-
Filesize
3KB
MD5b9aa92bfcc8002710712452cb82a03f3
SHA106ef26d558680054580655b13b13d4e9ae12f6d8
SHA2567cea5cfc43a5ab71da41a44b12164405163a26c88a0f334ef1cf8ba07ed70116
SHA512cd14ee7bc664d66fb0680f3d778929c438a04bb5f5dbe5742bee8ea2e6868893b9bc3dcf8452f2a6c7a3b2932911c5990229984a76fb294cdd64f0dee362f05b
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB