ae6999b1df3c18825cbfbc77d9c5f4e639d626640e5ffb3d290611878feda9e1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
License authorization Custom invoice INFO - Factura Aduana INFO (2).xls
Size 296KB
Sample240510-jmkffsee45
SHA256 ae6999b1df3c18825cbfbc77d9c5f4e639d626640e5ffb3d290611878feda9e1
MD5 46e7832ddba7b3a922920bd225871c01
SHA1 0fe9192b399572ee9c07907a9a763016f33d7ef3
SHA512 758ae5ba2682507d6598a099ce1df38217c2d2a3bd9e05ac0c16b97efbd3752293108f69f1cd15f3737c80bb8a842b92b5c0efa638684a4b60be033fc67678da
SSDEEP 6144:kZ+RwPONXoRjDhIcp0fDlavx+W26nAfphe4UcLe0JOqPQZR8MDdATCR3tS/+yIHl:FVUP/qPQZR8MxAm/S14neoZOxNl
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2996	EXCEL.EXE
5632	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeAuditPrivilege	5632	WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
2996	EXCEL.EXE
5632	WINWORD.EXE
5632	WINWORD.EXE
5632	WINWORD.EXE
5632	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5632 wrote to memory of 2760	5632	WINWORD.EXE	90
PID 5632 wrote to memory of 2760	5632	WINWORD.EXE	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\License authorization Custom invoice INFO - Factura Aduana INFO (2).xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2996

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 477645c7b83bbde8bdcf6d066f0de596d5b02fd47c223f89dde7d86903338cf9
MD5 fca8af0dc8436b9952fdf961f8c7f401
SHA1 ac194f887a84a4538985ece94daf59cea48fe65b
SHA512 ba0d8f654216d9530bec83aa011a3433cea27873be327ac60eb1244997995489db76e25077dead09fcd43009b05deda51fd37b30a33fff01c94ba3927e1c21d5
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 4ff207367bc3a17d3f1884846cf7863cfbb642709048c6af038270b0fa49e420
MD5 0dcde83e8608b1f7dd02be840f7df8b9
SHA1 434894edbf6e1dc09302929330222305b98b428d
SHA512 7c6009c6a71094626f5eb2acfb5e69d17fa6e4f5eb215a4152269d87c47758a1a07a89819ddc61ce19f4f1b1f220625413e8b69d7c29da35b26edc88d20e68be
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 663a082119912f446d62bec411cc8b19ca7736e44f584d283b9036b9a2b7cd89
MD5 595f2cd3922af6f795879adea7d44475
SHA1 c9357bc3a94a5e06b8a76b544976790c0de22475
SHA512 876b4544483330ea93c7532a0dba14631dc57ad2a740bd2310714fb87aeaa641b0db89515b062f40702460076d3cadec15bbbab978ec68d969cdfde9a73d80d6
MD5 SHA1 SHA512

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 21KB
SHA256 df267027c8fe98eb0c1ab224e9fe3bbdeee9a993b62ee741e492d7e21714f98f
MD5 a562297f69c7e3632b3d57c3564bf912
SHA1 ada836935e8d134552d0491f3a051764ed8cf326
SHA512 fa42a7c5c1c77852ff05d3d71cef1b32c82d87a066f801ea8176c8c79117aec69fc051e82e14ca62709c6a8e94be5364603e0356c978d83b745e39d1711712eb
SSDEEP 192:KjqM9eQz+OZPBrjmU9qwz/nrZ0MXjLF9Kzz0yZjsjjkvav9VIwzvXZgjpjAu9ymi:fQZGwzTazeGwQwmEsfPmv2PtEJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 743e29cc2f6637a7b75d6a56132e2b451b4739ce7561e7bde378349c42fd0fca
MD5 1ffbe2fa18986939317e8d8ec2b68fed
SHA1 a907a328d43874ec72e179f0f2ff74d09f14449b
SHA512 ea66e9cefd6f0cc305429a802abc9d26af0b284efc8a08868a2c66a96b3632918a5b6909822b87e4181ee87079f49be1eedfa7a9c663cd6931a675b2f48ca464
MD5 SHA1 SHA512

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 35e3c919c238975c2eecca6f1f2847c75af0fd68703998c4334268bddf4b6c26
MD5 05e1c0ceea6e1bdb30adc48faefc95ef
SHA1 ed83ac62461ee919f5180f2e83bedb7972c2cc08
SHA512 735fca792afad8edabb64506080c030471746c7dc16466955031000d8bf29c778a5b22235354aaa2f8a516339bfb2cc7a1a443fea59be6c2acb946d7c510ea18
MD5 SHA1 SHA512

Submit Download

beautifulgirlkeeptellingmeiwasintroubleandsheisbeautifulgirllovetheroseireallyenjoythebeautyoflovesheis____kissingentirethingstogethim[1].doc

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\beautifulgirlkeeptellingmeiwasintroubleandsheisbeautifulgirllovetheroseireallyenjoythebeautyoflovesheis____kissingentirethingstogethim[1].doc
Size 75KB
SHA256 8e7f6b531558a8e6b87072d856e5097cf1cfb5b0a6ec5be8bb2aa5c0a73ea967
MD5 07a9cf0368cad4b17cde67a7a60122a6
SHA1 481ca765be7603ec63f0246eaee49b8778ef69be
SHA512 c2bd211b8d5cbebed2f1fc9855eabf25a8f1189fdc8bb276805190bab00a4b28c06a8635728bbc655ad88942adc1c85a26a5d79d2842878f0545fa2dac076f53
SSDEEP 1536:xQirkcQePXHF0fcvedXwtH7CuojAfTfXdDbjtinXhsFtv0R0IlfcyXogQUBe3CV4:xQigbMHF0fhXw4jQTftDbjtiXhsFtvwe
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 229B
SHA256 837162cb4134cc275c2199c6502e552e82755ec29fa9aefae532dd66f166e21b
MD5 90d2cc4695069409c3f31b9308da4af0
SHA1 15f5b9218697558c8954629c13d124ad72a700ed
SHA512 d033fc825eea205f7bfb6299f1022beb77e9d11ea0a1127d5f1359624cb41055a03fb4551ac8c1379b4a562c4fb0ca964131a581a32fa7b264f4cc43680423f4
MD5 SHA1 SHA512

Submit Download

TM02851223[[fn=iso690]].xsl

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5 SHA1 SHA512 SSDEEP

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 b7b523e48279cfcdf8270469d69ee13dee4ba96cbcc5b2844d0149a52ea4a950
MD5 e7776bf9e48d42cc0a46661659552c15
SHA1 525d94e5a8f887a4e9e4a474eed61ece55a18544
SHA512 d055856a699ee92759ec80a2d9a7b4436462283aae7dd90eb300bb1ced8c6cc6e209a526ef0224e7dace7882bad0597d94fcd8ba989cd89cf97bf235f55bfdf5
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 5KB
SHA256 f87bbfe475de9922e4505e04700c44d0f4ffe87c608fed795988ba45fab01a1d
MD5 4d65627ed04dbbff7e7a53937cbfaecb
SHA1 6d6f1e9ae7ca07a4282c66f323a977c4be2bc74a
SHA512 4d1976c2ce7fde74dba059126c01a32a039ee29a9defcf7113ccb14d72ad27fd860894780035c8a70929a1bd63fac7098343f2c593f4d333931295d05972ecd6
SSDEEP 96:5/d9IgkBGuRNzIRNlJRNNcaRNtZxRNY8DO:5FhDiNzgNlnNNcGNtZ/NRDO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2996-10-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/2996-8-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/2996-15-0x00007FFA4D910000-0x00007FFA4D920000-memory.dmp

Download

memory/2996-13-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/2996-3-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

Download

memory/2996-6-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/2996-1-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

Download

memory/2996-12-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/2996-2-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

Download

memory/2996-11-0x00007FFA4D910000-0x00007FFA4D920000-memory.dmp

Download

memory/2996-0-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

Download

memory/2996-9-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/2996-4-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

Download

memory/2996-14-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/2996-5-0x00007FFA8FF2D000-0x00007FFA8FF2E000-memory.dmp

Download

memory/2996-70-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/2996-7-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/5632-38-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/5632-35-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

memory/5632-562-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads