Resubmissions
16/04/2025, 23:23
250416-3dkjmsw1ds 1016/04/2025, 23:22
250416-3crxbs1ms5 1016/04/2025, 23:16
250416-29atms1ly8 1016/04/2025, 23:10
250416-2523bswzgx 1016/04/2025, 21:45
250416-1madxsvzg1 1016/04/2025, 21:28
250416-1be52azmt6 1016/04/2025, 21:16
250416-z4vkrazlz9 1016/04/2025, 21:06
250416-zx2eqavygy 10Analysis
-
max time kernel
133s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-es -
resource tags
-
submitted
16/04/2025, 23:23
General
-
Target
virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
-
Size
937KB
-
MD5
0fea640a7da27f365b3675f73626b9c9
-
SHA1
fd4825f244e9c145486cb6930ad05695b9972668
-
SHA256
64af94592f6707505fa6f42b58776c3635706a414e6362a92f707df84627679c
-
SHA512
c9a10288762f3f5a3fdff17f8dd8560e7a884f1b83f405c2e85c6c86e42f69a30841c13aa0f2ecfc55aed42995d7aeb8fe40415e423ed0a306d2e7d00883dfbf
-
SSDEEP
24576:h3zS0aqbCrxgFhFSQVB5DjDLG6/8otVBTN9s:K9Fo5VLDLGwTBT
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Ta505 family
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 22 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\virusshare\1\VirusShare_0fea640a7da27f365b3675f73626b9c9.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD50e3ac1e452f77ada70be985b51b28212
SHA19357565a7e50b4ddf59ae0892d89eea4e6359e95
SHA256248d1df6211959a83452838a9f7720229f88313240a4aacee92f0cbc12e01727
SHA512c8dfd3a41ce7b63414f068d6459aab101ae922f3382db30644c7b613b16c77e4466b53aceab1aae916e44c090cdc6663059eb89185a27bc08dc4d79c6b310a69
-
Filesize
1KB
MD5234dd4489a069d6fe78f5753ae85eb07
SHA106cede24422ea0b797475dfb3f7d367a8df345a8
SHA25609d28586779aff1305d33630f15a7b58bd717ed1ccd901e9dbf64f551ff091ba
SHA51226162ec614362fe07ee44ce78ef38b660662e1d82296090ed0e9728abba31424a8c16fa0e7d32a064497a4769c2b13bfabea38a4856ec9fc63de616f2ddabe4d
-
Filesize
234KB
MD54224c05eb24238e24a124eecee907cec
SHA1551979d132b3e45aaab7ea8e18441b303f49a74a
SHA2566d5c207c998990f1e7c527971dfe0eb6d2b21fca136d616e6e211019d1c77698
SHA512ef4b9f06fcdd091ac818974cd777a6fdf5cd88a70f8f5fad33173ae70905b8487d60acb4af2ddb6c73d2789085f28ec1134e5efdc6a9659b0417d8fa350e7638
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB