Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 15:34
General
-
Target
KSACURFQAAB01.xla.xls
-
Size
645KB
-
MD5
0f35365b3df2274c5f34bd63be285912
-
SHA1
52571d67c3f6bb3db33dfb79bf157b181c6e9b6a
-
SHA256
8cd8de65f269a3096ab4090427fcb0d5f5ae99229f29465bc2bdb2c2ba304635
-
SHA512
e68276ad9a3cf89f3ce721dce123515efce9a22061ecde74d6662689c34229575dcfa72ff9a606a9148d07877f6b4b74397500d26bf206b56554df0377ba3dac
-
SSDEEP
12288:ebWNHd0zBVnumU9j/rVDWHlYG7GKanCl3qnklaYr+Uf:Ksd2u3FDWHlpVKXYr3
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\KSACURFQAAB01.xla.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe -Embedding2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5053054444020b01d0c9dbfbcba5ed17d
SHA1501b137b5cab5a6f58a7dcb216881ecf7f06d23a
SHA25687f0c052cd35c8e001e6e256f4ac4b3b7206249e984d0ec7f22cee3634c51449
SHA5124a195c176b12ca297d7c5f26f5450b6c52a9ef116f2d74e23ca041c1b2d80e61b817ddef35980b89bcacb77ce017af45aa7f2f01780f4fb62484729a013e67f4
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
32KB
-
Filesize
2.0MB