Analysis

  • max time kernel
    144s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 02:27

General

  • Target

    61718bc890c69da3085e39ae891336f349b76b739377ae010835920ba72d7315.xls

  • Size

    1.1MB

  • MD5

    76bd9584f6a265e3c2bfe63d525efeec

  • SHA1

    8ccf96ad8c846dae552135a39f4b1eabb11ca1a8

  • SHA256

    61718bc890c69da3085e39ae891336f349b76b739377ae010835920ba72d7315

  • SHA512

    f0dc84c5b80f7ada2ccc4777e9bf4669a65ad4b8642e7bddb303ecc709d537b213de1cb58f774fc34b9e175fb8322421ca515edbb266f4201cca1eeb4384aba6

  • SSDEEP

    24576:7q9PLiijE2Z5Z2am8afU/gY/tMJE8F84LJQods11ZsX7Gh:7EPLiij7Z5ZK8ayg8tMpFjLJQodS4L

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\61718bc890c69da3085e39ae891336f349b76b739377ae010835920ba72d7315.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\System32\mshta.exe
      C:\Windows\System32\mshta.exe -Embedding
      2⤵
      • Process spawned unexpected child process
      PID:1820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    f59dbdf0187527f62589cb0e8e7bf603

    SHA1

    aa5556daa12c1b48340b297ec2ebf38e800d5338

    SHA256

    30bf72f7907e19a2a21742089c1b93eecbb0e8cbf7334cd0d1cff0e05df3eb3f

    SHA512

    f445c654db5f08febeb9b67c7fceaf9ca799519cbd0ac732b38e9eef3ecc63c2dbd1351e02e75d3962bf9cb5b2b1c7358674321f480830cc4a89a1f1acbdb70d

  • memory/1820-43-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/1820-53-0x00007FF6D76E0000-0x00007FF6D76E8000-memory.dmp

    Filesize

    32KB

  • memory/1820-52-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/1820-44-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-18-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-15-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-11-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-9-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-8-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-13-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-12-0x00007FFC7A4F0000-0x00007FFC7A500000-memory.dmp

    Filesize

    64KB

  • memory/2884-17-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-16-0x00007FFC7A4F0000-0x00007FFC7A500000-memory.dmp

    Filesize

    64KB

  • memory/2884-1-0x00007FFCBCC0D000-0x00007FFCBCC0E000-memory.dmp

    Filesize

    4KB

  • memory/2884-20-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-21-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-19-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-10-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-14-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-7-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-6-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

    Filesize

    64KB

  • memory/2884-4-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

    Filesize

    64KB

  • memory/2884-5-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-46-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-48-0x00007FFCBCB70000-0x00007FFCBCD65000-memory.dmp

    Filesize

    2.0MB

  • memory/2884-47-0x00007FFCBCC0D000-0x00007FFCBCC0E000-memory.dmp

    Filesize

    4KB

  • memory/2884-2-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

    Filesize

    64KB

  • memory/2884-3-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

    Filesize

    64KB

  • memory/2884-0-0x00007FFC7CBF0000-0x00007FFC7CC00000-memory.dmp

    Filesize

    64KB