Analysis
-
max time kernel
143s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 06:16
General
-
Target
Swift Copy.xls
-
Size
98KB
-
MD5
524559bfe8623365f3e1569b5b58be85
-
SHA1
2638ebe72c1df88dd7d9ba66654c55160d41287c
-
SHA256
752387dc376a39db5dcdf2b0030bef0e516b1331b059fff96e4f87f48126a1c8
-
SHA512
c2b7f278e9827a53f325c94f736b04451f1021807be5b54c68534e6f2f1f24a51a7977bc762f8dd216d83821be8c85309d2b953117412181848cac877afcc454
-
SSDEEP
1536:BiqHy1S6F8b2SQrEkawpoXIoGks1Y5jWWTerlEdA5xwiglkk/UlvKBut:beFHrE2sIoGdYkF6y5xtIkk/Oi
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Swift Copy.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe -Embedding2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
668B
MD56442ec18b4e39559fdb743ca05ab3497
SHA15bda019eeb1f74cb04a1b93746f0cabf9077c532
SHA256847b624944cd558cdbcc0ff7308208c4f1838880ae28d17dc6b8709841ae600e
SHA512209091b1d1997b75fbb4c6fcb050aa50f4a4d39fafeda1e0dd418abb2b8576c781b01766b4e96d544de099c74b93288b892643f883b95074e33e22e14e662cf9
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
32KB
-
Filesize
2.0MB