Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
14/04/2025, 13:48
General
-
Target
virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
-
Size
937KB
-
MD5
0fea640a7da27f365b3675f73626b9c9
-
SHA1
fd4825f244e9c145486cb6930ad05695b9972668
-
SHA256
64af94592f6707505fa6f42b58776c3635706a414e6362a92f707df84627679c
-
SHA512
c9a10288762f3f5a3fdff17f8dd8560e7a884f1b83f405c2e85c6c86e42f69a30841c13aa0f2ecfc55aed42995d7aeb8fe40415e423ed0a306d2e7d00883dfbf
-
SSDEEP
24576:h3zS0aqbCrxgFhFSQVB5DjDLG6/8otVBTN9s:K9Fo5VLDLGwTBT
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Ta505 family
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 22 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\virusshare\1\VirusShare_0fea640a7da27f365b3675f73626b9c9.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD5f5a449cb64641e62a8dc6cc52e57f341
SHA1fbdc07f4418adc2ceb2d43d89ec1a44f86cec2de
SHA256dbc70c889bb08ab2fa59c776b6cb6f6b5f6fa6913929be6c8e729427a3b74991
SHA512da2e0605652d0325d17e871490cddc649a42158f4457cfc824dfd2f6e81b61e72785cc17beec00a6da49701a42e1e55b144459cb45903ccc50b236f4f9045d5c
-
Filesize
1KB
MD53ae98e0ea821a92d8857c8bd7a861a7c
SHA1668f9c1780e0b25bd07f62915f7a9704d30d7a85
SHA256ddfa2ea89bb21931e8beb9eb09866492c2d55572a3dbb6e1dd7aaca60d684592
SHA5127bdfc405a005de7915380fdb34012827db69e5cd870fe9a8a8fad40dcdd6e8d3d8dacfd3308f4e271702eb18303fcdb946cbb03cd6f084e60d229dd330c58ebb
-
Filesize
234KB
MD54224c05eb24238e24a124eecee907cec
SHA1551979d132b3e45aaab7ea8e18441b303f49a74a
SHA2566d5c207c998990f1e7c527971dfe0eb6d2b21fca136d616e6e211019d1c77698
SHA512ef4b9f06fcdd091ac818974cd777a6fdf5cd88a70f8f5fad33173ae70905b8487d60acb4af2ddb6c73d2789085f28ec1134e5efdc6a9659b0417d8fa350e7638
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB