Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
07/07/2024, 09:04
General
-
Target
scan_quotation.xls
-
Size
300KB
-
MD5
13b959799182e62cb2526bce11f86640
-
SHA1
54e26d1d3e6be7ab2024c4dbc26a6a0f46825d27
-
SHA256
a9f30c53cd799f9c4bfb94c88e098e508d13f32b4a40981aa09a957ae413c803
-
SHA512
9c1e7ec83c79cefcb19e8360915898d5d735bad4f56de8795ba4233ee631b81eced8931a312eb5c8957a50d8c8dfce806640697c9357054d0eeb7d38487fcd6a
-
SSDEEP
6144:0FLrfgZLIjy8UMfeh2P9SXViIyS6W9hitAL6Vut6GwwUoN3Y0b:0hoFIjy8XeoPi3FEmLkuYGLRm0b
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\scan_quotation.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5acb6848eb1daa55af85439f633688c85
SHA150af01e07fa029ea769bf603bbfd6e42f44dd342
SHA256ba702e61f97be7698561f1481bf543b64170b1ee4ce657e9d7fdf048c3e2631a
SHA512a2aeb082f494892958794f3e003c58af5ef9e2fd9fcf246e0d9d595cd4aec9f89ba333953fef158fc588e238864037e2ad9fed8f4fe692182b796203010cf673
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB