Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
14/05/2024, 07:20
General
-
Target
RFQ_83747384738757384754837483.xls
-
Size
420KB
-
MD5
e9212f8698d52e5edd37af6269efedb9
-
SHA1
26d0d3a31988fb4196acbb7d870ef322e48f1905
-
SHA256
8693450758e0567cf6601fbfda993b77c44cc206d0cc9f7141fbb0ccb2ff5f4f
-
SHA512
0a6eb41f063302aeafc604f7506275bae941a4a30935d6f1438bf4b9bea53f31f2fe867ed2a9083cd6711fe1d75d0748c7765e22ece65d02a5ae2cbe027de6fe
-
SSDEEP
6144:0Z+RwPONXoRjDhIcp0fDlavx+W26nAzKQunPSHBMixiMK6G+ZFrTUvCp4sJgLzXE:0pPQpozwjTqCfgLnt2MoZiBFyzX
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RFQ_83747384738757384754837483.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57c0669e6df38dff7b7019bb4eed41e99
SHA172e3db82fcbf67d6c421455de61df7b51f65dcb8
SHA2561ac809efcd227440a10b4842e2ea1765f85dc8042b41f4e0de29b7cfa5197992
SHA512e1a6e93fe372925d238cf1f487efe094d2c4a254faa432551ee4ee49b96a07a6a2ba257b698c103dbd08d4d9133d1ef24eb55dbb9c7adbbb048836e4d794dd2b
-
Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
Filesize
471B
MD518919a6ff07d3887f2118bada5d4b5a0
SHA1b2d5e4cfbf807b6af75fe8dae6ed6ba4267a5e84
SHA256d08d325bd1ad7f1b19858d1d4a531e83a4818b6e3f7f50dfc409726dd4278abf
SHA5121c145454c0c30f11875cdc4d4de0547c3606920cc97025023481e499b45debd5e1fade543da1d6e1d3b6c8fcc5c874f6c79f64a47403e9e850b12f381a29f49b
-
Filesize
410B
MD59e21bd914a0d523cd3803b892c3be0d6
SHA1b8455cf87abfaafaed23eb1028d1fd86a47197ab
SHA256c22d73d8f11ea6d6d83e66bdd93b85cfb177ee5ad06a699c3427dafa3c64a832
SHA51224e34017ca1634e7238555ee7038f5706442290d6b43748551f39530f9ca7dd5d99b4a612d4b9a33c5b625988d0b5ce20de3d2203269d916cbeb814489748223
-
Filesize
392B
MD589447230e21e4e495424b131e91a7970
SHA1cf93134a14248cd4eb3b5882926d5549b2494aa8
SHA256b25f0c14badc21d407d687f75358837058d1cae8f67e77735cb064b7b75f94e7
SHA512ca18dcebb3c4e9ba8bd578f7199f6638869ca1bcf4c1ff8239200dee620e2bec192ca28a710cdf964fe83c1a861830c0a0eccc0dfb38c1fbeee16548ac3bc322
-
Filesize
420B
MD5e300ea68dd0d416bc75968c2bd3706c6
SHA1a470b736a178730c23e96929b64a79a33eda0aa0
SHA256334fdd0dbd8b90ce76b4d9a4f215c3fe4f79dfd177d422be70cfecdc5b7f46ab
SHA5124bf924b996a5c885c4b595584550d0551a0688fe843fb70607733007c8552730b119b60e4f049e1baabaee0f7b14219604f6b72f55940427bd470b0e61e3029c
-
Filesize
160KB
MD55d2c6da084ec9c8c765c05b6eba1973d
SHA11336cab21573699fa14e3d5ae8a53194faaecc2b
SHA256db13720cf1a4cb9f72bea5ee7903978e2b63abf1bc4a5c3743ca54d3c44f0325
SHA51295ffa8959acda8ebd7efc3625599f0b2823df8fb34249c7da267d1f5a23fbb1d70a817d0f2ce39889ff4f6be48485df73d1232a988899e2208faddf05b0983b5
-
Filesize
21KB
MD5bf9e42cafd76fac0c8a2f312cd285a2f
SHA1917b3359668b14c12d7947837e8f87f791425199
SHA256cd9ed7a75b288025e9e1421d8ef71fdf0443523b3a69e69608c0cb31ccb20626
SHA51247e77d52dfa82b15cd94f6a9ea70e464937be6075d71099f10424d06108400de025198b2e8526b62cfb9e385b771cde67f1bb5fc48e8a68e3a908ae4c0fffb98
-
Filesize
2KB
MD50be9842afccf77c9ac43cb9ece4d6d0e
SHA183729a9dd43e5ec2f705cb58a2633b9b8ee38e69
SHA25660d8f0a2870e43849dc5e54eca99620ed6969d7c1449777a6bdabf62eea38aaf
SHA51254692473f3d60cc6caf1bfd4a1ad2ee95641a107e39ccf70f81e3c7d3c2338cb76ac206a2ea801dce35fdf97af23278c85820243a0101b517072c52b6693537e
-
Filesize
2KB
MD54d2f52a37cfd1f9a46e971a393c8ddea
SHA1d9cf2e600902643e9b98a1fabdd3a8f86fef0d51
SHA2568474b8f1a1b1667873697530cb89c374e01df1376360f2c89e091a38c9e59d7b
SHA512888427925c4d1d8acd6d5a639546ff8f1280563a9cc2dfdace4b4f1e61ce5b8137aa177f7870e4753507543c2b80e567a4453402a720d0ae3c9cedbe31d77966
-
Filesize
70KB
MD5b62da88f447201beef3ced60b101f1ec
SHA1faefa0e076669a0aa38de3093c3cd46889e2b50f
SHA256d6366d99252a9447bfff659e915bd596f4beba61c96ed9b0e9eaf4c20280118c
SHA512c5b3667466fc07330e11e43ec48e258367deee2ac46d30f8f728af1459aa2cc0a139d59691a99c14ec97cca10bb329f9f0efd99d03d2d1979f3f581305c25f33
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
229B
MD50799aa1240532a4f0d591cdf5c2ef0f6
SHA16ed783626cc6ac437bc749205046ba2130b55dc1
SHA256bcbfa7a8de52f35bca467a25fe0c4fb8fab26c519f45d43940c3074b106be1aa
SHA51267e908eab30bb5d92b15e57b52d3811f44b9dca5933a5a4053875f4e0de92ddb78d00be02609a088d7bf34b8aa53db20b331dfe416164e964b2b08a2ce5904ad
-
Filesize
3KB
MD5757000dbe96e76cfd05a2da5b5cac904
SHA1dd2f34c1e02b2d90075d271b73b135736be07640
SHA2565f2577903cf4638a5c8ca5bc3487082f5c7680862d5e7bebdd377c9305893dd6
SHA51253067ceea2eab5fde9072243d11566d6099244e239526c419c917bb768f5765f618e7953fd57d174df9512d37c05688e789564a7a6b52f9ba3fa4fbf0a92c3a9
-
Filesize
5KB
MD5ef812c89ca13c801ed9d559f6aeeb4ba
SHA169ddb758757e6e862e76eeb65b7ac8d06e9a5b1b
SHA25607257368a85a27b71d1a82aca1631d3987c6692e793e93b6babc852ba4273b01
SHA5122608054a826ee21fd6131113fe38c4fdd5c7e0999d6e95dd3b9e1b4fa550ac95eb2e72b379c4d16bf1af8356ff45f881433a84c3f4a2effd62c784f105e620d5
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB