191a46b3849f0cc60ac2e0a3387585dd9c34e2b28cb66bffdbda08238ee53710

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ref19920830281982938RT.xls
Size 308KB
Sample240527-jq71xsda2x
SHA256 191a46b3849f0cc60ac2e0a3387585dd9c34e2b28cb66bffdbda08238ee53710
MD5 f5051793b6c98a29efba84f3821d1e30
SHA1 b6b446e72525796444ae132fbb6af6788f08c5de
SHA512 f8be2d2f6596deb0aac8d4770ba3cde80a39f3abdda9f9c32e0fd337c3a127fb518220bfad65528d29b9c4fa23a2312cadc08f9e2a3ababf1c9be4d44db9a9f6
SSDEEP 6144:QKHTwu2pQHTIIwJsl5mAwKTwVbE7s9NEfUuqMQTZabPYDX:5QAExhKTWESoQTUPYD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1072	EXCEL.EXE
5000	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeAuditPrivilege	5000	WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
1072	EXCEL.EXE
5000	WINWORD.EXE
5000	WINWORD.EXE
5000	WINWORD.EXE
5000	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4104	5000	WINWORD.EXE	103
PID 5000 wrote to memory of 4104	5000	WINWORD.EXE	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Ref19920830281982938RT.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1072

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Size 471B
SHA256 53a6045ed07f02deaf979d308ff94f5c3d46ac478fcfc9c71b0300a370415f7f
MD5 3f09e61e5f4f61c26bb13af8dd599ef5
SHA1 0e99a475ee6ac549890e4c7fa44a835d60722197
SHA512 c1f2c7b8c62c23a4b035039a4c17bbcb8084a5805e13858ebbf6bdba9b6a0b678d88b3cf4e2d46c5cc002d3ccaee62cdcd4516d4be1d7a47e0a9bbfbacefa0b1
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Size 412B
SHA256 971b1efa8faff8b5d4a3c7d2962e773e0e5ca35a86226f6fd5b05a2bcaa74eb7
MD5 f892bbe8150989cf9eef3e400ba0f31f
SHA1 0bd37592bb2f3956ab184028e9f3b88616e99d2f
SHA512 a96a8c84cc30a40917839aa95d7b4f16ffffb334c852ebf6946e6e43934c975aac56cdc83abb1e5ebc50e6f3a1a082b49ed8a3310445a180f40692f474805fb8
MD5 SHA1 SHA512

Submit Download

81384C6A-43AE-4C1F-B6E9-4E4D7A9EC09F

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\81384C6A-43AE-4C1F-B6E9-4E4D7A9EC09F
Size 161KB
SHA256 07dcaeb3c31bba91b1c3c29043fbcf690b4d34dc9933421ebce3018cb1c34f1a
MD5 b38c94e3033882e1f9eff45e12a9f664
SHA1 b2e1f052ce987d6d0ed238ab0dfca1a77dd2598d
SHA512 453da3b16e3f9220275a7bc66a98fcdc33955ad75b796626e51a028fc045ab978fce005c4016ece10b10a77cedbcece027c29ea64e4fc22f82b927038e1e10c8
SSDEEP 1536:g+C7FPgOdB3U9guw/JQ9DQA+zRQok4F77nXmvYd8XRPEwreOR6Y:IBQ9DQA+zIXuMT
MD5 SHA1 SHA512 SSDEEP

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 21KB
SHA256 cbb7d3f8c2c7b2eb8554ce20b348add8ed2648193aa4cb582f5fd6b883dcbca5
MD5 adaa9c1b872fe4eff68f4965ebb1b27c
SHA1 fc55081468a46b4732e2768b8894e338ec3e7d89
SHA512 0f2e4f92dae482dc736385b1c9186b984f12105df6c618012fa4b3ca6e05f376be478efb4926094564358cc9571eb30d595a46e7e5ba494a944c8c5a2ee0c710
SSDEEP 192:bjJ39aczF5ZKIBj6s92Qzq6ZnxycjNv9u1zpbZI8EjSk9WYz84ZZ3aHjNL9e1zVZ:GcpQQ9yp1JFYda+1cbksNi
MD5 SHA1 SHA512 SSDEEP

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 98b319ad4566c3993aa3d073bb5bd07865efc9b930237233bcfa158d931efb7c
MD5 b5d5ed2b67c04ec5057ad0e2d85f2cca
SHA1 7b119b75f5e7d5612951dabd174dab4513905751
SHA512 9705a27d1c756140ada50d87258e60a98fbf172f6b6486528724923143a2528eb76047a9c47a476a473c075da62efbfd8301bd49af79c9f4ee3be5fa6b2a2db1
MD5 SHA1 SHA512

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 c50dd96d04e3d0fa2705465a128659ce9225b20b7b9ebbd7e3525a20a7299520
MD5 1960a92f26b6716e71fa0964d93197d7
SHA1 4028cd4a4da6c31b7e765e8a572e95ca67bbdb3d
SHA512 34ff5ec2a04c57d02d5151be93ac11659080427e51dabf9895f9ba3f7089813795b0874b29bb4b72e075637537109646050490c4a656cf7b4de49391196f1fdd
MD5 SHA1 SHA512

Submit Download

lioniskingandtigerisalsotryingforkingbutdifferentistheattitudeofthistwoanimalaredifferentlionsisalwaysalionitsucantcomparewith__anyotherbecauselionbeauties[1].doc

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\lioniskingandtigerisalsotryingforkingbutdifferentistheattitudeofthistwoanimalaredifferentlionsisalwaysalionitsucantcomparewith__anyotherbecauselionbeauties[1].doc
Size 34KB
SHA256 4bb44d988825a04032c6e4ed62a631698dddee523cb1efe0ad6422492b939463
MD5 d92d4f4a1d9dd4151b48dba9c911be5e
SHA1 41391287e7442a0629bebcee4a09b5c751c3334a
SHA512 5e422753e2ddac52698bd07582404effd943acabb9d48ef3f37d6ead1ec6c1883329c597208b6e963dd172c3514a89cdf2ccbf395147646bedcdf976f5eb4663
SSDEEP 768:nkGIquUU/zwBePWi7KBm2J8V0pdnw7h+5ck:kGIqu7/zAA37Ko2Jy0pFGk
MD5 SHA1 SHA512 SSDEEP

Submit Download

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD25A9.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 228B
SHA256 b52ebae0545d2cfb24f4ec1a1c88d7cb73c4d401fb53288012dd60924f69dbed
MD5 e1957bc071709a014ff18215f052ee29
SHA1 88e522afe88ecf0e17ba01ed1e067d0c5f545f32
SHA512 b4e2e04e5fba97063fa2b411915277747267446ad0d9978059c2a8cc21f3394ca74a2ce064a402b111f0c28766d519621854ffdd1986a302a97d5f807d276ad4
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 5KB
SHA256 5b0caa349ec48497e5a0ca184a7af68f7dea3bf1546dcb54347ffe5a51ecfb9d
MD5 97b4127f8fc5c0b929e3a35ba9df7421
SHA1 84042e28c83aab4a8ff2043f2957817b29fd04c2
SHA512 9bece94fd3a60c50f82f470f95089754ea8cde327a512584e8d4edeb5251501192825ce1a6657fbd722fe14fc6a900b30bfa9f16d1278cf89bffe7a80b9f41a0
SSDEEP 96:c4chkQ5gGbToN6R4KFlQoCRGyWo0RZUkouRct5VTKoLRcdbDV8ok:pchzbco4KFlheGyTEZUNiSVTv9+bDV1k
MD5 SHA1 SHA512 SSDEEP

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 0ac3c307d28f0cb40066e6704837ae7faabd5bf764112fe605b6a16b02ac0536
MD5 a253f8cb4f4e726a31374c83da59f178
SHA1 aa361f90f366ff9f5ff3e7bdee4e688da5e13516
SHA512 9e4023edb101f8494a886167355c8bdd45834e0bd860d524ea3d8c70dbf368975ae3e1beb0707059a7f2537a6dc9aa2b1c2a5c2a18578bc95925d4d1b4ac3566
MD5 SHA1 SHA512

Submit Download

memory/1072-11-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/1072-1-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp

Download

memory/1072-12-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/1072-14-0x00007FFBE2B50000-0x00007FFBE2B60000-memory.dmp

Download

memory/1072-15-0x00007FFBE2B50000-0x00007FFBE2B60000-memory.dmp

Download

memory/1072-558-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/1072-2-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp

Download

memory/1072-3-0x00007FFC2500D000-0x00007FFC2500E000-memory.dmp

Download

memory/1072-8-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/1072-9-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/1072-10-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/1072-0-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp

Download

memory/1072-7-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp

Download

memory/1072-6-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/1072-5-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/1072-4-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp

Download

memory/1072-13-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/5000-32-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/5000-33-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/5000-29-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

memory/5000-559-0x00007FFC24F70000-0x00007FFC25165000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads