Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 11:51

General

  • Target

    Purchase Order_45020.xls

  • Size

    635KB

  • MD5

    8bb23c70321a50ccae1047cb639b816e

  • SHA1

    79358c1f386045803c6941fa3f3cf22bf6116876

  • SHA256

    f72e4cc0eef0ec4857e235dd3f92cace525b1edc104feda10ccdbc22ca3609bf

  • SHA512

    a2a698943777a8bfcc9f977eed424ec59f9a2219ab7c073c8a386ca1dad37730fdbd8072dcd56bb2989ecb9115c41ba34bb9f451d92c11f089f50f24a8db242c

  • SSDEEP

    12288:lw+LYINaL66YVYhsxsIWviBk6ZCZuGTyJYCEBeF5hQ+rXonXv6:lLOuVYhWEZuGWjnhVr

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Detected phishing page
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Purchase Order_45020.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\System32\mshta.exe
      C:\Windows\System32\mshta.exe -Embedding
      2⤵
      • Process spawned unexpected child process
      PID:3404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    77c0deeb17bed854776ea65cc0c41bfa

    SHA1

    96b56f961a1db971fcb9968831607d4b767ebae4

    SHA256

    5f56b65fcf311c2e9d9548b4445186420a7efac9b6975571d6a461d7835bd08f

    SHA512

    275355e78df4453f9536aa201c8dcde9d9da4531ab039467ac630ad2c1443ef8e5d6d16085bc97a25313ed5d9ead14a92143f506c2b1f413ae959e3bfd0a1f6f

  • memory/2368-6-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-3-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-2-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-4-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-5-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-12-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-8-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-7-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-0-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-11-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-13-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-10-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-14-0x00007FFF10E50000-0x00007FFF10E60000-memory.dmp

    Filesize

    64KB

  • memory/2368-9-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-15-0x00007FFF10E50000-0x00007FFF10E60000-memory.dmp

    Filesize

    64KB

  • memory/2368-16-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-18-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-17-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-55-0x00007FFF5302D000-0x00007FFF5302E000-memory.dmp

    Filesize

    4KB

  • memory/2368-21-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-19-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-88-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-87-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-86-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-84-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-85-0x00007FFF13010000-0x00007FFF13020000-memory.dmp

    Filesize

    64KB

  • memory/2368-1-0x00007FFF5302D000-0x00007FFF5302E000-memory.dmp

    Filesize

    4KB

  • memory/2368-54-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-20-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/2368-57-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/3404-58-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/3404-48-0x00007FF7FD650000-0x00007FF7FD658000-memory.dmp

    Filesize

    32KB

  • memory/3404-46-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/3404-45-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/3404-44-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB

  • memory/3404-42-0x00007FFF52F90000-0x00007FFF53185000-memory.dmp

    Filesize

    2.0MB