Analysis

  • max time kernel
    100s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 07:36

General

  • Target

    PO VEEST2024-25016.xlsx

  • Size

    1.6MB

  • MD5

    43833393b399b9c3ffb3fa54dddf70ce

  • SHA1

    63b2403b6ca0ecdb75645ff24fba5f7c69a0706a

  • SHA256

    4f2890801a7e8aecd34c4dcdf0767614335a8de5645798d23bbc4f209f46843a

  • SHA512

    466aa278892a7e832c0e6502e3219930bce48634f8e6bcbd0b30409f6fc1016b031c376b6fc55903cb26c66b2124417a47ad3f6ae6f92fa534762bbc5b458994

  • SSDEEP

    24576:3RYDTqzotogcdMQzJ2p1t9a999XvDRpLHe3VeHKSuZ2lTPVRo+Zs:EdeMQzJ2p1baD9XtpL+EOZ2tPVeMs

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PO VEEST2024-25016.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    671B

    MD5

    56b36e1258979eaca0679ef95293f1ec

    SHA1

    b244c0e0ff87ac6106791e2a0799a2dbff6adb13

    SHA256

    af99dab9cc12e1515c4d1a208cbccb4778fc461ab93e816e31c9f201a4e0842b

    SHA512

    01d27e85671588a88a406f443d7552dcb33fe87aee80e3e84b67b0ec8bdff6017c676e0e6708ca891a71dd71d572d59faaaf48a58e37505ee26cfe4f0221c597

  • memory/892-15-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-53-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-11-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-4-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB

  • memory/892-5-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-7-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB

  • memory/892-8-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-9-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-10-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-6-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-13-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-14-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-3-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB

  • memory/892-2-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB

  • memory/892-34-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-12-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-17-0x00007FFCF09B0000-0x00007FFCF09C0000-memory.dmp

    Filesize

    64KB

  • memory/892-18-0x00007FFCF09B0000-0x00007FFCF09C0000-memory.dmp

    Filesize

    64KB

  • memory/892-1-0x00007FFD3322D000-0x00007FFD3322E000-memory.dmp

    Filesize

    4KB

  • memory/892-32-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-33-0x00007FFD3322D000-0x00007FFD3322E000-memory.dmp

    Filesize

    4KB

  • memory/892-16-0x00007FFD33190000-0x00007FFD33385000-memory.dmp

    Filesize

    2.0MB

  • memory/892-50-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB

  • memory/892-49-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB

  • memory/892-51-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB

  • memory/892-52-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB

  • memory/892-0-0x00007FFCF3210000-0x00007FFCF3220000-memory.dmp

    Filesize

    64KB