Analysis

  • max time kernel
    125s
  • max time network
    130s
  • platform
    windows10-1703_x64
  • resource
    win10-20230621-en
  • resource tags

    arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30-06-2023 13:09

General

  • Target

    894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7.xlsm

  • Size

    50KB

  • MD5

    793c5a832ea9b3c4a225bc96b4449bc2

  • SHA1

    168afc78144b659b18b606a26c3e9a6343dd104a

  • SHA256

    894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7

  • SHA512

    df041addb6c8113b2add5439f8ce258016233a47a13a3d540187872e4ac25fe3ac87b016bb391a703e0cb73189f1720c0e723b6df47ef971238312ed77a9b607

  • SSDEEP

    768:V69cyRJvh5wVkTHmKNx9gcpLy4TB8wNF2XpL2rQUydmRSLLMO:VwJJvhqkTGKL9lPRNc5eQpdmRUMO

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://harleyqueretaro.com/renew2019/Back2016-12-22/cv/data/RjuiFMp4Fsp/

xlm40.dropper

http://hoatuoiso1.com/replace/fVea/

xlm40.dropper

https://rumkeke.com/wp-admin/A8/

xlm40.dropper

https://www.restaurantgaig.com/wp-includes/HLDoANj/

xlm40.dropper

http://www.grandfurniture.com/thegrandbrands/eGd55tEm9qkPNOhViP/

xlm40.dropper

http://www.hiway91.com/wp-content/Y/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:356

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/356-120-0x00007FFB73EF0000-0x00007FFB73F00000-memory.dmp
    Filesize

    64KB

  • memory/356-121-0x00007FFB73EF0000-0x00007FFB73F00000-memory.dmp
    Filesize

    64KB

  • memory/356-122-0x00007FFB73EF0000-0x00007FFB73F00000-memory.dmp
    Filesize

    64KB

  • memory/356-123-0x00007FFB73EF0000-0x00007FFB73F00000-memory.dmp
    Filesize

    64KB

  • memory/356-132-0x00007FFB70AE0000-0x00007FFB70AF0000-memory.dmp
    Filesize

    64KB

  • memory/356-133-0x00007FFB70AE0000-0x00007FFB70AF0000-memory.dmp
    Filesize

    64KB

  • memory/356-292-0x00007FFB73EF0000-0x00007FFB73F00000-memory.dmp
    Filesize

    64KB

  • memory/356-293-0x00007FFB73EF0000-0x00007FFB73F00000-memory.dmp
    Filesize

    64KB

  • memory/356-294-0x00007FFB73EF0000-0x00007FFB73F00000-memory.dmp
    Filesize

    64KB

  • memory/356-295-0x00007FFB73EF0000-0x00007FFB73F00000-memory.dmp
    Filesize

    64KB