Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
53a72f1f77a45e47084294a0103726076af1b4eef291b034639e1cfb99ed597d.xls
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
53a72f1f77a45e47084294a0103726076af1b4eef291b034639e1cfb99ed597d.xls
Resource
win10v2004-20240802-en
General
-
Target
53a72f1f77a45e47084294a0103726076af1b4eef291b034639e1cfb99ed597d.xls
-
Size
295KB
-
MD5
ec1d37555fb0c9c1b55e198f319efb15
-
SHA1
10e5e0c0a996ccdfd0ca4cbdd6f55c2c49d13dc6
-
SHA256
53a72f1f77a45e47084294a0103726076af1b4eef291b034639e1cfb99ed597d
-
SHA512
173ccb3ec44e96f2048ce7d93c0d7c2225b9b74d2e2a2c486b0c262d05a11c3a912cbc3995f6a72f01acbd9bc738cbc055303b8a678e7e3283d1195fb9532830
-
SSDEEP
3072:XMAJbziaeKJD49xYDJqAnHkE0AcPcWmmIZhojyXlSihEVC29p459aHunCHbcfEE:cqDsxYDJqAnHcTcW4PojyXzEP9r89
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2360 4840 mshta.exe 83 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4840 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4840 EXCEL.EXE 4840 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE 4840 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4840 wrote to memory of 2360 4840 EXCEL.EXE 90 PID 4840 wrote to memory of 2360 4840 EXCEL.EXE 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\53a72f1f77a45e47084294a0103726076af1b4eef291b034639e1cfb99ed597d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe -Embedding2⤵
- Process spawned unexpected child process
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5bad2fafaba5fa707aba98e32884d858d
SHA10885bdcdf31c0a26aa5616ee13591799c1f0065f
SHA2564e910f956b7ce9db04a0420902373b1508c3040c2f787ce452579aeae166d814
SHA5125dfb507c253e9ee668e38de75749092e46c4af5a762c9ea4e55d3f54dcac7984621c306276d106ca6459927f38be493f8655485f708b506f4c06fef92e09495d