Analysis
-
max time kernel
140s -
max time network
132s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
16/04/2025, 07:28
General
-
Target
virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
-
Size
937KB
-
MD5
0fea640a7da27f365b3675f73626b9c9
-
SHA1
fd4825f244e9c145486cb6930ad05695b9972668
-
SHA256
64af94592f6707505fa6f42b58776c3635706a414e6362a92f707df84627679c
-
SHA512
c9a10288762f3f5a3fdff17f8dd8560e7a884f1b83f405c2e85c6c86e42f69a30841c13aa0f2ecfc55aed42995d7aeb8fe40415e423ed0a306d2e7d00883dfbf
-
SSDEEP
24576:h3zS0aqbCrxgFhFSQVB5DjDLG6/8otVBTN9s:K9Fo5VLDLGwTBT
Malware Config
Extracted
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Ta505 family
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 22 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\virusshare\1\VirusShare_0fea640a7da27f365b3675f73626b9c9.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
627KB
MD5f1e696f22a9638681ec7fbd8129d2269
SHA1c7707c2a65c0c768f6b2c36e40c9454dcae419b4
SHA2564c7fa7e34b86d207260aad0ce814407ffeb70c6d7e9888a2049fb2bd18511246
SHA512df504af79015d7a6609c3159925b40f8b744602c043c53c1f10643000b6b28cc3c0dc2bdc262c32091d587295c5efb634dd56f05e8541f2ea092b1d2d91f23cd
-
Filesize
234KB
MD54224c05eb24238e24a124eecee907cec
SHA1551979d132b3e45aaab7ea8e18441b303f49a74a
SHA2566d5c207c998990f1e7c527971dfe0eb6d2b21fca136d616e6e211019d1c77698
SHA512ef4b9f06fcdd091ac818974cd777a6fdf5cd88a70f8f5fad33173ae70905b8487d60acb4af2ddb6c73d2789085f28ec1134e5efdc6a9659b0417d8fa350e7638
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
328KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
328KB