Overview

overview

8

Static

static

1

44e65a641f...5.xlsx

windows7-x64

8

44e65a641f...5.xlsx

windows10-2004-x64

1

decrypted.xlsx

windows7-x64

8

decrypted.xlsx

windows10-2004-x64

1

Analysis

  • max time kernel
    187s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-07-2024 02:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    decrypted.xlsx

  • Size

    2.1MB

  • MD5

    711fe9b027c5f6e0cfd51694b69da120

  • SHA1

    b32c2e1b63aaba1103d2f9b38dfa39c6b9cc2780

  • SHA256

    4e05084fe9a60bba11a1b0941b4264d8dbebc30be1630a06f05f86c4466b1510

  • SHA512

    33405b40dbbae9294c3df14a22545e0ae8a9acc26cac69ea6d6e6c00138105e1fc4523352169187a1fa969a7b455eadcc35d52bb1048d365b3007722607d06ed

  • SSDEEP

    49152:xaphEoOdnowYVpoDzFNnyKfENk1HA3p5PGeRgcT1Md3Qvpmd:Av2lapmffIka3pZlTWOpmd

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\decrypted.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4884
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4256

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
    Filesize

    1KB

    MD5

    676ff59b91d59f85c2ddddad6e21cd45

    SHA1

    b080b93c4a02c96f36b594fb9f5b94fdb27eee58

    SHA256

    8b4982feb9e325a497c9c1414a414e0023a811ebe90b4da365821016a7622f22

    SHA512

    43bd67fff120e56f16bd1df1115e161d72b4976b18dd5189c52b184a62fd96cee21188a698c5ee6d70357380b730ae114f7cc88434c1a4271085bd0b591afc87

    Download Submit
  • memory/4256-42-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-43-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-44-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-45-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-46-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-47-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-48-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-37-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-38-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4256-36-0x0000020023840000-0x0000020023841000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4884-8-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-35-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-14-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-13-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-16-0x00007FFD4E400000-0x00007FFD4E410000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4884-17-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-12-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-18-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-11-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-15-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-10-0x00007FFD4E400000-0x00007FFD4E410000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4884-9-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-6-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-1-0x00007FFD507F0000-0x00007FFD50800000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4884-7-0x00007FFD507F0000-0x00007FFD50800000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4884-5-0x00007FFD507F0000-0x00007FFD50800000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4884-4-0x00007FFD90770000-0x00007FFD90965000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/4884-0-0x00007FFD507F0000-0x00007FFD50800000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4884-3-0x00007FFD9080D000-0x00007FFD9080E000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4884-2-0x00007FFD507F0000-0x00007FFD50800000-memory.dmp
    Filesize

    64KB

    Download