Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 23:12
General
-
Target
d918e3e78a25986e395c1c2ac02fe322d3cdb887e6ace4ce0a9a4bfdad695410.xls
-
Size
663KB
-
MD5
64ba951987cc51900db5f1f35d5e836d
-
SHA1
25efcd9c5e536c2223bd36714da20da29441880f
-
SHA256
d918e3e78a25986e395c1c2ac02fe322d3cdb887e6ace4ce0a9a4bfdad695410
-
SHA512
e92844700b8d67ca37c231c1117289af0771ec6a7c88b1f3f96fc9d43a3a578bcdb7e9e55fd88a483317d5482e4f755b1f7733aca373fba049fb2f2c412c3710
-
SSDEEP
12288:zfIQEkONm1fwD6C3BPFEWUVsj/pqviXDXK2L:z3NF1fw6iQipqvGVL
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 27 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d918e3e78a25986e395c1c2ac02fe322d3cdb887e6ace4ce0a9a4bfdad695410.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
MD5c0b90c288e7f475b39fd1c5f1adcf9f8
SHA14a86715726cde17263805749fb3d91b5432be53c
SHA2568d9c350504278b7abd52446b42f0e883261f481ad04c5d78034f1e80c2848aea
SHA512dafbf63bdd9aab1878159493973ec2a303e3cd95ec04c2a1dfbcfac62f8ca3a490115c40a243effaf1b71a2299267e9197ea7675bdebc8e9e73ea5ea891c741e
-
Filesize
1KB
MD509a9af016441c3095a0dc321e0615e7d
SHA19b96db48204409ecdcf22254fd22b27559c349ae
SHA25667d78422a59185f26acf7a39d62e0230e759f9e0ea7243e56d8a5144f9bf5913
SHA5124ac7a4eaedcf4638c19646dbe3a4fa9bdfd082ee90135e88224f980677c0ce6e09c037cc255c68861d5cb9643a0598ba0765aca2329c8a36dbb36fed0e9163b8
-
Filesize
229KB
MD56264d92d659888cf34dbb0c32f431754
SHA1ed6066021529d0839f4b6afba2188a35ff295d69
SHA25686a5c5ba4f2a63fa5b6ae1f6e6b57d52a44ee41bf1c9bacae55fe51ed9f1b080
SHA5127196bf23d966b0c8709b0ec9d5be692ce9cea3fdb0e185b2bea4c7b09d5effe142060618b0964ad48cb02022b0406e54d5641ae56d20fb16cd915b7d07a2e52d
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB