Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 09:07

General

  • Target

    Quotation.xls

  • Size

    1.0MB

  • MD5

    7a9a6e2a484c942e9247513bf8420f13

  • SHA1

    9a0399a2c75537687cdcaa939adb4a871b56f26e

  • SHA256

    c0484101a8ad9d96190d39f100d6a6ed337873df68eb587c74a91b5cdd19cdd5

  • SHA512

    a48ad2da1dddb561a8a64414a8576e03180dccc65cedb94e4733c1d7dba3f8881230d6ec7bb10fe495e13e5fc7449585f52921f9d05d3d1f41361e0b99ec3d2c

  • SSDEEP

    24576:QCvOsc3umX8S4lMiK4uwQP6DdRgLd5+HKtGboP:QCG2xRISDdRgLQu

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Detected phishing page
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Quotation.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\System32\mshta.exe
      C:\Windows\System32\mshta.exe -Embedding
      2⤵
      • Process spawned unexpected child process
      PID:408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    20027ba84ae3f3642a88a2f6010f2f35

    SHA1

    3be4122787603891ca3baf5d2a8624ca8c5d9327

    SHA256

    baecfa0a690faa5ef8d323dbbde6974b69c02abc09819496040754d5071af9c8

    SHA512

    062b863625702d69cf4dddd8000ec3b6cd37a433de2ab37f7bb01a7f2b04e8b0004ca629df801f3737240ae649674d41d6af3c9fc2bed88a05f001151930c5d0

  • memory/408-33-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/408-52-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/408-47-0x00007FF7E8190000-0x00007FF7E8198000-memory.dmp

    Filesize

    32KB

  • memory/408-37-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/408-36-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/408-35-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-5-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-9-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-6-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-13-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-14-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-15-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-17-0x00007FFE57E40000-0x00007FFE57E50000-memory.dmp

    Filesize

    64KB

  • memory/1628-16-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-18-0x00007FFE57E40000-0x00007FFE57E50000-memory.dmp

    Filesize

    64KB

  • memory/1628-12-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-11-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-10-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-7-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-0-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-8-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-4-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-3-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-2-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-48-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-49-0x00007FFE9A58D000-0x00007FFE9A58E000-memory.dmp

    Filesize

    4KB

  • memory/1628-51-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1628-1-0x00007FFE9A58D000-0x00007FFE9A58E000-memory.dmp

    Filesize

    4KB

  • memory/1628-79-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-78-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-80-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-81-0x00007FFE5A570000-0x00007FFE5A580000-memory.dmp

    Filesize

    64KB

  • memory/1628-82-0x00007FFE9A4F0000-0x00007FFE9A6E5000-memory.dmp

    Filesize

    2.0MB