8406a1d7a33b3549dd44f551e5a68392f85b5ef9cf8f9f3db68bd7e02d1eaba7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8406a1d7a33b3549dd44f551e5a68392f85b5ef9cf8f9f3db68bd7e02d1eaba7.xls
Size 75KB
Sample240517-b29pwsbd2w
SHA256 8406a1d7a33b3549dd44f551e5a68392f85b5ef9cf8f9f3db68bd7e02d1eaba7
MD5 2a51de8a350568990f2e561a32bda2ad
SHA1 c1d881834223b650a68bf974e9cc8076ec3efea6
SHA512 fa32ec87311eea440e4530326964988f0275bd165eb44d51a5e61b8b9fa566a1e43e5290c80c99268b44220be2763ff31bf4a157e7a8a6e3a0915872a4f8e699
SSDEEP 1536:wYI9+CqVner1aXWFPoE5u6+8/CH4ysG1uIKlcyaB9SuAJ:wYI0Td0tFPSwbI8cya3S
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
344	EXCEL.EXE
4264	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeAuditPrivilege	4264	WINWORD.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
344	EXCEL.EXE
344	EXCEL.EXE
344	EXCEL.EXE
344	EXCEL.EXE
344	EXCEL.EXE
344	EXCEL.EXE
344	EXCEL.EXE
344	EXCEL.EXE
4264	WINWORD.EXE
4264	WINWORD.EXE
4264	WINWORD.EXE
4264	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 3128	4264	WINWORD.EXE	96
PID 4264 wrote to memory of 3128	4264	WINWORD.EXE	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8406a1d7a33b3549dd44f551e5a68392f85b5ef9cf8f9f3db68bd7e02d1eaba7.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:344

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Size 471B
SHA256 10129790502ba8d329e082d940b4c2591ca8c2c1fc344ffe4e6071ad3b10d2aa
MD5 2262a41af1b61c2a5ce02d0544f3753f
SHA1 cb14924423d24ba6dd974a4f0f4e4aac20f8faf8
SHA512 ca4267a39e7d485c36c439995bda34337b4270ad00bc4a270f0e54845616292232e456e60193d9a9f91c13f99f15de0c067a02902e638d7619f5d5504f5b7762
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Size 412B
SHA256 49dcb2491c2dd33410b6bc1562a0f79418ad4e85a9e1e8e7fa62f9c0bf56af13
MD5 dc4032c65063c623ce7311389d6d5727
SHA1 3f8d4a6fb5de8514694968967e895d67aecb983b
SHA512 d88749831411ccc507b309f357522b0252183cdd210dce49b20c59046fe12387aa273520e1b0d13b039d5ad2e661628b573c06c6c4f1421e6e26b2550c718af6
MD5 SHA1 SHA512

Submit Download

5322DC9B-2456-4B84-BB3E-B09D523F2A10

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5322DC9B-2456-4B84-BB3E-B09D523F2A10
Size 161KB
SHA256 a74da2f4d333fa83159640a9d33a88219664d3f8249507339575c404fea1f0c7
MD5 6f4b500de2c99ff47c75a2e8db16d2f2
SHA1 9daa5a0755c59319cf041fc2be37bf9e9b2678ee
SHA512 7c7d7b78d031c7e2783d721cecde5e656419969e3d90287db03a18943a44af13d04f3f8e6a025dc81a96a5dc792a172b9ea6ed8e705c8616e2005f69df010468
SSDEEP 1536:E+C7FPgOdB3U9guw/JQ9DQA+zRQok4F77nXmvYd8XRPEwreOR6Y:UBQ9DQA+zIXuMT
MD5 SHA1 SHA512 SSDEEP

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 21KB
SHA256 9dd2a84cd30a85a0b8a73368712f523f846e7ca9382ab6e0b37c618e55875e9a
MD5 d80431601229e9dd988b1b13b54ae127
SHA1 30869db364c41b437c2a313dd59f2aa2c2466e50
SHA512 5f8f3e96f69901ee10eab7d85e1c5b698b496b706ceff0e091d52b27b79bdc7c733d62bd30b8a92564516394fec50cc396de31b537b83cb6b04b1535fd08a1b4
SSDEEP 192:YjAG9Wyz7DZQj2g3jK09ugz/yaZvBEjdHzH92q+mitpzm9a9ZK8njZP9eJzcOZvT:ByYegpST8q+mitpy9yuJfACQ22XKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 4f36fa326cc56a2abc8e41207f94e646665346ae0341a11b5d72eb590b23b86c
MD5 0883804a989f2fffd0de5dbfb7814565
SHA1 797ad317fea6a8d0142b15e85f80c87eac581488
SHA512 4a1157957734b9352bc98c1ef11c699b19f26789dc59af186f3c0132f31bd1b0e39a1e33e6bf051d500737c018670e2c10e5e40a146f42a58d655e9e8dde4c4b
MD5 SHA1 SHA512

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 90f96c2014449e1b89997878538211fff69c908bca57f932efe521c4ebb90241
MD5 99b3bf5f270fca633600f254129cf44d
SHA1 4b796d428a0682da756de71046760f6f9cf5ceb4
SHA512 6a4933b43ed11a6adbc91e5adae35e94a1c37df9debd9975e79c33aff0f520127f6da0434a0f4f74400fddf8193fab99903d62073fefcb2c551cdce0e5dfd0fc
MD5 SHA1 SHA512

Submit Download

evengwalkreallynicetodoforhealthbecauseitsabeautiuflthingshumancandoveryniceiunderstanduntilinotdoingmrngwalkitrulyfacehealthissuebecause___trulyneedthiewalking[1].doc

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GOWSKSPC\evengwalkreallynicetodoforhealthbecauseitsabeautiuflthingshumancandoveryniceiunderstanduntilinotdoingmrngwalkitrulyfacehealthissuebecause___trulyneedthiewalking[1].doc
Size 69KB
SHA256 208af8e2754a3e55a64796b29ef3a625d89a357c59c43d0ff4d2d30e20092d74
MD5 8c2e6ab3fa1fe129f426869952a3a1d8
SHA1 ef8944509c1b1d99555da59f6718c92ad960bb3c
SHA512 5514e5e9544b0afecbfb74ac87830d150617e292ff70d8282e362c1e07e7d7f450d60e42678ef0338bb412c1db664b8be5849fb6757467d2f0c3bdbeefbb73b0
SSDEEP 1536:dEE9w/y46FMb1keWyUnNwn0peICsFz4SZiTno4DpvTjyYtcGQiB/3a72ospGYlkM:dde/kFMb1ke2Nwn0pEsFz4QkfDp7GYt3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDA4B2.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 232B
SHA256 b16c62dfbe44d01d0d75c8d9267e291089d7e368ba27a1d4b795c07e0f926aaa
MD5 a8b56c28facddc6ba59cde4757b19106
SHA1 bac0054a01eae895143f2ba7f6377d2c226dc75d
SHA512 a3063d2e489db53ccf446997ccc9a6b0679f8db4d8f5359c54d0132b752f87196d551df1c18dd374730df183ac68d31f1c3319fc8b7d8fd6292a26960463f9fe
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 cc1a94f337af0d7ec7dfcd6073ad8af4d7614ec25b78044eda4eff48853f022e
MD5 ad5a51ae35e9277ada993ac0350b945e
SHA1 7d86c429259b32a3f12406a9599f034f7c02f993
SHA512 8a1752b89e5cdfabcea1c632247943202cb2874002cd0d8ce80763e52c1beca953601bcb9e585975171fa99e57d5cb3072387018cb73dd57024bc14fcdc3768f
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 5KB
SHA256 59969f2c8d205026871857560336c8ffd8342b536b35d235da83160327dee4f0
MD5 60de34b5726a9a317f7bd4143036a439
SHA1 86fa0949d893537589892c2fd3041f7f270c7cd4
SHA512 71ba85b2729b68935d5ec3ad6310de7c61ecc9703d70d38c813b16deca034576d8c264f101e6a5b191021e20323a3bd0ceb49f7034e26a1b68df3536867e9148
SSDEEP 96:RWfkkpGysRzHk7CQ6RpkqmRSkAKRxCkTjRvFkDx+:RWfk7yMzHk7CQmpkqqSkAWxCkTlNkDx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/344-1-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/344-9-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/344-609-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/344-603-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/344-600-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/344-10-0x00007FFB30E60000-0x00007FFB30E70000-memory.dmp

Download

memory/344-4-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/344-6-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/344-7-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/344-8-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/344-601-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/344-5-0x00007FFB7356D000-0x00007FFB7356E000-memory.dmp

Download

memory/344-544-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/344-0-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/344-3-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/344-2-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/344-11-0x00007FFB30E60000-0x00007FFB30E70000-memory.dmp

Download

memory/344-602-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Download

memory/4264-547-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/4264-26-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/4264-29-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/4264-30-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/4264-610-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

memory/4264-28-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads