Resubmissions
16/04/2025, 23:23
250416-3dkjmsw1ds 1016/04/2025, 23:22
250416-3crxbs1ms5 1016/04/2025, 23:16
250416-29atms1ly8 1016/04/2025, 23:10
250416-2523bswzgx 1016/04/2025, 21:45
250416-1madxsvzg1 1016/04/2025, 21:28
250416-1be52azmt6 1016/04/2025, 21:16
250416-z4vkrazlz9 1016/04/2025, 21:06
250416-zx2eqavygy 10Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows11-21h2_x64 -
resource
win11-20250410-es -
resource tags
-
submitted
16/04/2025, 23:23
General
-
Target
virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
-
Size
937KB
-
MD5
0fea640a7da27f365b3675f73626b9c9
-
SHA1
fd4825f244e9c145486cb6930ad05695b9972668
-
SHA256
64af94592f6707505fa6f42b58776c3635706a414e6362a92f707df84627679c
-
SHA512
c9a10288762f3f5a3fdff17f8dd8560e7a884f1b83f405c2e85c6c86e42f69a30841c13aa0f2ecfc55aed42995d7aeb8fe40415e423ed0a306d2e7d00883dfbf
-
SSDEEP
24576:h3zS0aqbCrxgFhFSQVB5DjDLG6/8otVBTN9s:K9Fo5VLDLGwTBT
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Ta505 family
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 31 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\virusshare\1\VirusShare_0fea640a7da27f365b3675f73626b9c9.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
627KB
MD5b66817dbf66a48f51b99fb61540d75ef
SHA1bb2dba0173eabd76afdebaa4a1e6510480bc6fb8
SHA25627ddc0f52267dece22d65aaf698ec352d2543cb0a99d953b94a0fe55017bede7
SHA51253a55da2a47e88e0dc812d3c529019e08c8629ca9f6088bd86ca293629c51a399384b14873f834c49d0c43b521d8a7f5dd10eef0535bb6c16ffe2a7e22cf9a0d
-
Filesize
234KB
MD54224c05eb24238e24a124eecee907cec
SHA1551979d132b3e45aaab7ea8e18441b303f49a74a
SHA2566d5c207c998990f1e7c527971dfe0eb6d2b21fca136d616e6e211019d1c77698
SHA512ef4b9f06fcdd091ac818974cd777a6fdf5cd88a70f8f5fad33173ae70905b8487d60acb4af2ddb6c73d2789085f28ec1134e5efdc6a9659b0417d8fa350e7638
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
328KB
-
Filesize
2.0MB
-
Filesize
328KB