Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 07:40

General

  • Target

    Order4500318042.xls

  • Size

    229KB

  • MD5

    ef04a12bc8c36b451d4b9da3cd9d36d6

  • SHA1

    cf13b2aedb7a44209a7d8bbe4694150834fc50e0

  • SHA256

    c4266d2a1d05270a41a4959ab0143f13655790c4c9fc189088b46302a367567a

  • SHA512

    cc9901d0ef11be9a8e7d79fd7b5c744637afa376a50990259d303f2c0448f5fd18e8c8691daadc92a8c1203d820eaa86db45ca165f572be01ffd2df37dbb25fa

  • SSDEEP

    6144:6d4UcLe0JOqPQZR8MDdATCR3tSv0W83l0MUl73/aLKMml:9UP/qPQZR8MxAm/S8W83lObaLK

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order4500318042.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3540
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4912
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:4184
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5348 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:1128

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\A0BE7F14-15B4-4200-91F4-5FCD1CF7A518

          Filesize

          160KB

          MD5

          d9197381e71f45ae22feb283fe8f8614

          SHA1

          acab585e87c91141f57113bb12679d71ce0176b0

          SHA256

          da99f9291f1d625c7746942dfca256b3c953f54dcc8b2e26f8e66d1974df71db

          SHA512

          642ac6f9edd1d2902226cbd8c683aaa4e81d053eab01a2d94eb2103c3fb5915be78798304f57a3fed35fb5722f5aef9948dea78f1dcce8c2714407f91605d95e

        • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

          Filesize

          2KB

          MD5

          f638eac0da3ba4894021d791ad020502

          SHA1

          1ac22d1def61d20cffe2150bbeb04fb2a9a4e753

          SHA256

          8e71234689a1012fa1837a41da955bfb05be637b08d77f1727b1ad5ed9bc3ed1

          SHA512

          7c4529d606bf5e5b10c4b68b07114a7651b8bb883537becd6954571a89434936e4362a68b9bb28fd951c350aa299c53b5b8d1b30695316951a0a3242da616cf4

        • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

          Filesize

          2KB

          MD5

          4dd5cdbcdc63e32f09b484717eb7423b

          SHA1

          ce6257eb685bcf488df7ea80109e7c45bd00b1b4

          SHA256

          f9fa6685d341cf55e1af1d97ebf510b835c989d2be30d858b014ef6772f49364

          SHA512

          fe3f1a80ea78d581c665644cf8be55a1788c6964351a0363c7351341102b9d380c85e7b7dd5f37c90b3206d8c93ba0bb0df0cc7612787bbe35d9756e9b455ae6

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\dayisagooddaytoheargoodnewfromthegodwholovegodtrulyfromthehearttheyhearinggoodnews__godisgreatforentier[1].doc

          Filesize

          81KB

          MD5

          1aa76ce00f01882d5cd3d712b8052bc2

          SHA1

          b0cb1b9a8ada2812a013469ff5cf736b0f8da933

          SHA256

          9ae7ad0d29ba6a855eec28c8dca1b7b43063677139463dc54640d4232489d029

          SHA512

          ac7d9b0319aeab38a8bdea8c6094a4a73266d83ea4ee4974619bdc641197e58f1402089a9ab67a679df9920884214cfd5b69a4dcc9d8c3aa0d62165a67dcbdcb

        • memory/3540-10-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-123-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-5-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-117-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-7-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-9-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-0-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-12-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-13-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-14-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-11-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-15-0x00007FFD1CD90000-0x00007FFD1CDA0000-memory.dmp

          Filesize

          64KB

        • memory/3540-16-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-18-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-19-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-17-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-23-0x00007FFD1CD90000-0x00007FFD1CDA0000-memory.dmp

          Filesize

          64KB

        • memory/3540-118-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-8-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-6-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-116-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-115-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-4-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-3-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-2-0x00007FFD1F2D0000-0x00007FFD1F2E0000-memory.dmp

          Filesize

          64KB

        • memory/3540-56-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-1-0x00007FFD5F2ED000-0x00007FFD5F2EE000-memory.dmp

          Filesize

          4KB

        • memory/3540-62-0x00007FFD5F2ED000-0x00007FFD5F2EE000-memory.dmp

          Filesize

          4KB

        • memory/3540-63-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/3540-64-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/4924-73-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/4924-47-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/4924-44-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/4924-43-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/4924-46-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/4924-45-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB

        • memory/4924-124-0x00007FFD5F250000-0x00007FFD5F445000-memory.dmp

          Filesize

          2.0MB