Analysis

  • max time kernel
    143s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 02:23

General

  • Target

    544e3a275c258b90d8cda8be36b057e75451b4901d4663082db9f97419cd5a4a.xls

  • Size

    1.1MB

  • MD5

    f8136a20dbec93a03aaebaf7d36ff199

  • SHA1

    be5e9c920b7e3c61b0b7779c6de6bc28d9aab2d3

  • SHA256

    544e3a275c258b90d8cda8be36b057e75451b4901d4663082db9f97419cd5a4a

  • SHA512

    f2d85f7ddcda4704ca2b057f94386772f4951b0e9b7fe015d9ee39d017267007080dc1f95857182045438f7fc7dac16098e6710611f3c409921b186c3200446c

  • SSDEEP

    24576:aq9PLiijE2Z5Z2am82/gY/tMJE8F84LJQodsG4HD+zBVc:aEPLiij7Z5ZK8Qg8tMpFjLJQod94SP

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\544e3a275c258b90d8cda8be36b057e75451b4901d4663082db9f97419cd5a4a.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\System32\mshta.exe
      C:\Windows\System32\mshta.exe -Embedding
      2⤵
      • Process spawned unexpected child process
      PID:4876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    36cf0c181a83f35cc8de25be34cfa3ad

    SHA1

    3e1110bf9c7b54e24f5205f2da9314361cb9e938

    SHA256

    17aae8ffe8556b87667416ad546b20890111943c4a00326cfd3d5ff472feae36

    SHA512

    3a42d88643a9eca7e5bf732e089172905df153ae4f8f92bbbc883a484376091244893bd643344a436519f63db75332ee0144efd16d3d79c9d51767f5f03515dc

  • memory/452-12-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-0-0x00007FFE0E950000-0x00007FFE0E960000-memory.dmp

    Filesize

    64KB

  • memory/452-13-0x00007FFE0C820000-0x00007FFE0C830000-memory.dmp

    Filesize

    64KB

  • memory/452-5-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-6-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-4-0x00007FFE0E950000-0x00007FFE0E960000-memory.dmp

    Filesize

    64KB

  • memory/452-7-0x00007FFE0E950000-0x00007FFE0E960000-memory.dmp

    Filesize

    64KB

  • memory/452-9-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-10-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-1-0x00007FFE4E96D000-0x00007FFE4E96E000-memory.dmp

    Filesize

    4KB

  • memory/452-3-0x00007FFE0E950000-0x00007FFE0E960000-memory.dmp

    Filesize

    64KB

  • memory/452-2-0x00007FFE0E950000-0x00007FFE0E960000-memory.dmp

    Filesize

    64KB

  • memory/452-8-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-14-0x00007FFE0C820000-0x00007FFE0C830000-memory.dmp

    Filesize

    64KB

  • memory/452-11-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-41-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-39-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/452-40-0x00007FFE4E96D000-0x00007FFE4E96E000-memory.dmp

    Filesize

    4KB

  • memory/4876-35-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4876-45-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4876-46-0x00007FF6517B0000-0x00007FF6517B8000-memory.dmp

    Filesize

    32KB

  • memory/4876-34-0x00007FFE4E8D0000-0x00007FFE4EAC5000-memory.dmp

    Filesize

    2.0MB