Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 02:41

General

  • Target

    a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls

  • Size

    1.3MB

  • MD5

    6a5b15d9e6bb033e46489be8cdd09849

  • SHA1

    c67e28a3dc3bd24b3013ed445e961dac2bc40905

  • SHA256

    a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9

  • SHA512

    f3af74171844d7a91de289921b670215b5534c7c7a98e707e2750fbc2c46705811ce121f02fc2bab7b269e208dd1796de385e3aab4a19ec9ebb369843de77e76

  • SSDEEP

    24576:TCEyzgdI6eFAj99CB5ml31tD1HlmKQPpsmsyX1JRIwIz1QVEl:TCEwT6eFAj3Cjm3HlUhOa1nRRVA

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a908acf29dde8279b28c8b1b15892cf602a90a0d387b904176d63d7eac0203b9.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3868
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1772
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:1836

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

        Filesize

        2B

        MD5

        f3b25701fe362ec84616a93a45ce9998

        SHA1

        d62636d8caec13f04e28442a0a6fa1afeb024bbb

        SHA256

        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

        SHA512

        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      • memory/3868-14-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-17-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-2-0x00007FF9034F0000-0x00007FF903500000-memory.dmp

        Filesize

        64KB

      • memory/3868-4-0x00007FF9034F0000-0x00007FF903500000-memory.dmp

        Filesize

        64KB

      • memory/3868-5-0x00007FF94350D000-0x00007FF94350E000-memory.dmp

        Filesize

        4KB

      • memory/3868-8-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-9-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-15-0x00007FF900B90000-0x00007FF900BA0000-memory.dmp

        Filesize

        64KB

      • memory/3868-49-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-3-0x00007FF9034F0000-0x00007FF903500000-memory.dmp

        Filesize

        64KB

      • memory/3868-12-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-11-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-16-0x00007FF900B90000-0x00007FF900BA0000-memory.dmp

        Filesize

        64KB

      • memory/3868-10-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-7-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-6-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-18-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB

      • memory/3868-0-0x00007FF9034F0000-0x00007FF903500000-memory.dmp

        Filesize

        64KB

      • memory/3868-1-0x00007FF9034F0000-0x00007FF903500000-memory.dmp

        Filesize

        64KB

      • memory/3868-13-0x00007FF943470000-0x00007FF943665000-memory.dmp

        Filesize

        2.0MB