Analysis
-
max time kernel
109s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
08-06-2024 15:13
General
-
Target
16a5c537528512a1cb6745bb42f02a85112e33e0970caabb93ea839a03012e05.xls
-
Size
902KB
-
MD5
ad0f9670a92556bd6be7a6467c9fb5f6
-
SHA1
99cade3df54169713491edc5c5df4495f45c67ee
-
SHA256
16a5c537528512a1cb6745bb42f02a85112e33e0970caabb93ea839a03012e05
-
SHA512
7cf8c044115a664c2fed3d30bf95d119c64955032e5ac88a11c14f8a69f25197831eb61771a517fdd437f6ea7c92a38b004335de57b2ff02037f9c1dbee0588d
-
SSDEEP
24576:pOga0xf5JmaQramc5LXU3OldOCuvN9Jpt:ZTf5Tz5LXy1l
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 27 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\16a5c537528512a1cb6745bb42f02a85112e33e0970caabb93ea839a03012e05.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
562KB
MD507a81f46fe29837636a001443338077d
SHA10cc48b12e41453e075efb57188478603c775cd87
SHA2560eea6c3c1ddb84f3f44591379c9d336f95d83a5386a032edbeccc64384ac5a9d
SHA5120e14adf5c1090b5ec4e77b697c52f5b0f5cfec74cb711cbf2b46b37a041869e02b824a2e73ca10017bbe5506f303b91f320973b7609d8300f10e11b4b82ebf05
-
Filesize
247KB
MD509e74e3455326976d15afa01d2cb9217
SHA13ed469af986abb331dbc3af734406211ba278ae1
SHA25680d72b63347f9fa70ac03fafcc46247b400ef2cbbb258f1bb55aa4981faf03fd
SHA512aca18f2fc17d9342d743e8275369b799fb57f382e313f134c8c0022e4a1f7fbe684c0930866aabf87db000533e5eb8f88ee7a4f1abf0a5e9d870124f6fce9ac1
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
336KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
336KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB