Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2023 14:40

General

  • Target

    44bf9208061fc6ffa4a54bd7dd501555.xls

  • Size

    233KB

  • MD5

    44bf9208061fc6ffa4a54bd7dd501555

  • SHA1

    51db6d6d78e22361310d527d8a457d21650ecb75

  • SHA256

    13294b459f5818173f0eddd6e90f6737b8e5c0ef0f83eac4766f7e902558f010

  • SHA512

    07587e386175f41230863e19ca180bd8772973670148b3c6a2a600ac17aa34a6b42fc83aed17f7db204c621659c496e6902134e415796ec6034a9692304b6256

  • SSDEEP

    6144:9Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgC93WPcZZRRrq1RObTwvOkPDklgvS3+nQ7D:B93tDrmcbTwvzD63fLvfP1GO1

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://maxdigitizing.com/wAbCNMUm/pp.html

xlm40.dropper

https://turnipshop.com/ihiRzoi1/pp.html

xlm40.dropper

https://dynamiclifts.co.in/1PWQQcv0D/pp.html%20

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\44bf9208061fc6ffa4a54bd7dd501555.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C:\Datop\test.test
      2⤵
      • Process spawned unexpected child process
      PID:1744
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test
      2⤵
      • Process spawned unexpected child process
      PID:2828
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test
      2⤵
      • Process spawned unexpected child process
      PID:1512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9f557541bff18eb1290e64a36af74454

    SHA1

    bbc7c5880be0c0b53d4ec3ffde9d07de2fb086de

    SHA256

    f25ca9667a477a92ad7181b03beb560e7aa83daf9596712ead710d8fec3e59a1

    SHA512

    d6a8958044364c502eca3a5c989c837314c756cd9323e2c05eddf85c72130802d707aeb7a93a5dc4a9175d96f4e7b088811ebce1224cc7dd795484dbd4bdc665

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    68daad61aa71a8843df97c5f6fb3fb58

    SHA1

    edbb376c84707f60e892da509e8dc882f1dfdeb5

    SHA256

    5f6e58624d7ffe2a2c7e5dd73c879c43a2ebbd03c4eb87434e6aea74cba08e05

    SHA512

    f77c338143bc519808c316f7d581ebf058d3534342e18ef912f8111d633defb0a0f49a69d4a25ed24606695c8514146b409c9c4768cc3c12b9e4280bc1095993

  • C:\Users\Admin\AppData\Local\Temp\TarD50.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/2364-1-0x00000000724ED000-0x00000000724F8000-memory.dmp

    Filesize

    44KB

  • memory/2364-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2364-104-0x00000000724ED000-0x00000000724F8000-memory.dmp

    Filesize

    44KB