Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows11-21h2_x64 -
resource
win11-20250411-en -
resource tags
-
submitted
16/04/2025, 06:43
General
-
Target
virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
-
Size
937KB
-
MD5
0fea640a7da27f365b3675f73626b9c9
-
SHA1
fd4825f244e9c145486cb6930ad05695b9972668
-
SHA256
64af94592f6707505fa6f42b58776c3635706a414e6362a92f707df84627679c
-
SHA512
c9a10288762f3f5a3fdff17f8dd8560e7a884f1b83f405c2e85c6c86e42f69a30841c13aa0f2ecfc55aed42995d7aeb8fe40415e423ed0a306d2e7d00883dfbf
-
SSDEEP
24576:h3zS0aqbCrxgFhFSQVB5DjDLG6/8otVBTN9s:K9Fo5VLDLGwTBT
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Ta505 family
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 31 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\virusshare\1\VirusShare_0fea640a7da27f365b3675f73626b9c9.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
627KB
MD58a5dd40bb8537f6708ac10ec251ec070
SHA1d3f2bffc615cc2610efd818ee7a4b920236a5b89
SHA256d91df16dc56191c1756166c1f4ba62571eb62c047dc86dc771e5cb02797eaa32
SHA512e2cd41efe7ae9ca77db9cebc5ee9dbd43e4e6bc82b2ca7b1a3e7d372e2adf6478ee430a46a87ba35e5dd24a7ec1a28874765ddb9032fc5471da12cf70ed211c4
-
Filesize
682B
MD5a352484e0673d7a5919567cd91d723e5
SHA13119767c50ae507509629a6b799dafe15f1c9b6b
SHA2566b4e0667ba77f6bdb99e9944b072cd1669f28d34841a55bed36c6c6fc253d24e
SHA5124fa02e5f79d40bbbcfc82df9058775d1d7fe9084d53335f79d06b72d7fd7af1d907eec1a8a46c2c1fa7e5cb3f26fc61b792a1c37943fdb1bf464e7b7bb7b00ae
-
Filesize
234KB
MD54224c05eb24238e24a124eecee907cec
SHA1551979d132b3e45aaab7ea8e18441b303f49a74a
SHA2566d5c207c998990f1e7c527971dfe0eb6d2b21fca136d616e6e211019d1c77698
SHA512ef4b9f06fcdd091ac818974cd777a6fdf5cd88a70f8f5fad33173ae70905b8487d60acb4af2ddb6c73d2789085f28ec1134e5efdc6a9659b0417d8fa350e7638
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
328KB
-
Filesize
2.0MB
-
Filesize
328KB