Analysis
-
max time kernel
144s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-10-2024 07:05
General
-
Target
Updated New Order.xls
-
Size
938KB
-
MD5
39e2230ab8f6d983bee40367b44d0d99
-
SHA1
92e81d6b42529bd3171b4541ea252fce6ba3c010
-
SHA256
ed0b1f5749e23d2494de9cdeda7aca03c44690e22dfbd2f4b5f96baa73986406
-
SHA512
2d9e2060a4251c50e3d32896d71025fc57c2e588d5cbd88ce0c9ba52287f4e40d4775f528958032f7323c3f02d3a0e9e39872e5427b5ed3e9dbbfcd8234ba90c
-
SSDEEP
12288:UmzHJEjwWYSRD3DERnLRmF8Dl3PT7uZNPK+N4Uu/UbH0ilKLdcoCYd8Eojy1f9w:ncwHSRbARM8B3l+iv/UbUxLdwYLom1V
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Updated New Order.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe -Embedding2⤵
- Process spawned unexpected child process
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1296,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD583ca28cfbdd83ae1cd2e17ba858aed4a
SHA18a10667825f3d436bbe7b11a43020b14d1c83f09
SHA256802e0fb67070a518962ca2d703b1d837bbe23714c2fdf05c506a0800a7327d0e
SHA51230f0913e166e1aadf2b863a19794eb8e1a24550ccd3cd23287b66fd7d4860b6225d941bf92be5d3cd2ce2e9c191aa1b0365f60a1328f99d2bcd31369f200f72e
-
Filesize
2.0MB
-
Filesize
32KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB