Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 00:54
General
-
Target
order_inquiry-000293829294829489343.xls
-
Size
111KB
-
MD5
486261c3d7edfb458815e95c4f78c122
-
SHA1
7c32a4a65f77260be36b30e5a6b925baa4d4bbb0
-
SHA256
095f25938f2489a4e70b174bc4eb1fdaf2ed956cf9c9efd8d4602103bc77af3c
-
SHA512
51c9fccbb6bfaf2b7748fdf6f9f0e4f1cf82ac2686b3f9c51513a251a34796f2eb790832e20d055f654c51237872a2180c11c12828d8b19338464d08c2e94354
-
SSDEEP
1536:RRlTjKXZuqDBvnXOrFbn1pYBcTs1L3BX64E7J2auv0iJ5fCPMZB+XQMKss0oStH2:9K4QB2rF71HIhjEt2auffCPkhqtv
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Modifies registry class 37 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 19 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\order_inquiry-000293829294829489343.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\order_inquiry-000293829294829489343.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD585ad173999ed440af6120f3b4fd436fa
SHA1eebe3bae40b0c82db581b905e2a4c4a90055c9b3
SHA2562fb3e7ca57b5ec8657ff2b909c74dee246e7ed2b30abd60dec96fc4fb88bd165
SHA5123c506252a27bc4a3d718fc2ad89036850ee3c9d5fd79966fc5e28debe1844d96e8d2777e160e8537034129fd8109dff027bf5eb4a082c99d0db93730ec31427e
-
Filesize
397B
MD52f82426450332b558a61ae9ca551abd9
SHA1abdbf8f8bdd7572bcdefbd1e0b7da8d3cf17144d
SHA25657d6315a8f1f11aaa111a9956ddd0d560f791f757c379ed77bbb5a1b5b577f52
SHA512dbc43dab6cbde98647c5a88cd508a1528ef79c030286cf82cb4cb03c4af81930ad1c3b2644ead9eceea27cd5772324f42a51f04f1693102254567205a6abf0b5
-
Filesize
161KB
MD59d8f362c65013ad999177612ac86bbfa
SHA12e5b0fef2c3194fe7bdcceb2265ee29ea1e1b379
SHA256eb3dbcb9ef068520affef50d31d2a2918cc18b62a7f0a34287d4d621c4b7679f
SHA512e13ff81decf5b45b21a7afbc939d888c6f2ba9e495e39a00071fe9f8ead1f6bbf1c7c646c0ebf533aed489e98d9a3ee1f495f967e1b01e701e21d3ffb4d5eb9d
-
Filesize
323KB
MD567f36f3c0ac40b3318b0241f929fe06b
SHA17b9aee92f248b674b974a8469fd0b0ddddf6243d
SHA25659f39c79c6f4ce39372c39f194fea499d0bf1eef2ecb2f2b7a941898fd7200f2
SHA512d58458e054b4c202a887c57b234cdce0913ed83481237700d70ac51412273289d49dcf79c29f06a1b87749020a66a4b7b3a280886ff8ae0c60e5cbc9debef279
-
Filesize
52KB
MD57b7afdf24b4ba9dcc824fa29d0f8bcd9
SHA1c6e4fd4cd8bee6f469506c97bc0b31bdd43799e9
SHA256c956a67241b8b1c2358e2d56f07e38d90b6e499ee85dc62ef989491a73c9c68b
SHA5125ba1a5288a77610613b6bda7234dd600411bdd7a29b61becc75370abcec6c3bf23bfc491076affde992d49ca3c6c0c099f4e4db415af72a10c668649ae0b57cc
-
Filesize
2KB
MD55208a67f750ecce12a723987a2b43e37
SHA19e27998bc5a7b543cb60f75ead67cbee99e6660f
SHA256f37d9d298336dc7cd7b23f3e32cf1dc56070cb8b34710e923961d2ef75d1b6ea
SHA5121d92828c192aef4cca2db9ad595e7d7eec975277352ddd7fb64f19d01a17afb7a617abc13e0322ae86c73f81139de5c1b9c5484751624b6b79cda6516c9987c6
-
Filesize
318B
MD5fd86990ba8bf8c646ad369401c510c62
SHA117daa1ab7814757308839a93a636125e852aac88
SHA256e05008a5b5e975d63ac8b118735c9eb1bdc8be2ef1a9b87dc874fb364a910b43
SHA512a1f564ebd5b7355c8bf21f657ce9d78a3a0892b4fcd97d2973ac9c9414565c89ccdd11763b1d224f3bd645e2f6779b656df6f25f6bd76d160bb52e3948a3b6e9
-
Filesize
738B
MD581590dec172a42a5e9872f702197daf5
SHA1c6b1bf88c5ca026bfe852c98c1e605c667a096e5
SHA25684aab2825e0c44ec867bc544b9630dd7f275b8db86f22a79d985b9390a0e1638
SHA5122fa76e6750c08a86b66d5076ccf05953edd3be4a979fe46d2a020dd52f001a3c3cc993d172c5005ebd903a16bb570138e549450f31b97a4f5532cdc46746922c
-
Filesize
24B
MD54fcb2a3ee025e4a10d21e1b154873fe2
SHA157658e2fa594b7d0b99d02e041d0f3418e58856b
SHA25690bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
SHA5124e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB