Analysis

  • max time kernel
    143s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 07:07

General

  • Target

    ALFATECH-4500068045.xls

  • Size

    331KB

  • MD5

    02b90b88aed63a901dbcb9f1c06e34c1

  • SHA1

    0744024e070c8840acf9f787c18d279c242d1734

  • SHA256

    a4004b765b4e62bd32933c91301f783d2b864bbb45cf9ae35f0b6681078bb40d

  • SHA512

    b9394b6b59287940a94faceda10c584aae3155765e4bb88bbda4b04fe3bc23a1bf44951398ba723913c2c0c661a77c3efb6b000ff5a2efc312dc95c4bf81f901

  • SSDEEP

    6144:c/WOvPZ8NdyOseQAz1Wapbb2zIFhzBvxaLqRRZYj+oUzCJeYILmCL1P:IWOX+PsJAz1p9fhzBIqRR4+BYILt1

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ALFATECH-4500068045.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Windows\System32\mshta.exe
      C:\Windows\System32\mshta.exe -Embedding
      2⤵
      • Process spawned unexpected child process
      PID:64

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/64-34-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/64-48-0x00007FF6C2320000-0x00007FF6C2328000-memory.dmp

          Filesize

          32KB

        • memory/64-47-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/64-39-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/64-37-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/64-35-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-14-0x00007FF8093C0000-0x00007FF8093D0000-memory.dmp

          Filesize

          64KB

        • memory/3092-6-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-11-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-7-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-13-0x00007FF8093C0000-0x00007FF8093D0000-memory.dmp

          Filesize

          64KB

        • memory/3092-12-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-5-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-4-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-0-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-10-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-8-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-9-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-2-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-41-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-42-0x00007FF84BC0D000-0x00007FF84BC0E000-memory.dmp

          Filesize

          4KB

        • memory/3092-43-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB

        • memory/3092-3-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-1-0x00007FF84BC0D000-0x00007FF84BC0E000-memory.dmp

          Filesize

          4KB

        • memory/3092-77-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-78-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-80-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-79-0x00007FF80BBF0000-0x00007FF80BC00000-memory.dmp

          Filesize

          64KB

        • memory/3092-81-0x00007FF84BB70000-0x00007FF84BD65000-memory.dmp

          Filesize

          2.0MB