Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 17:05

General

  • Target

    fb29c33662a5cb0c39d2e96907b963b3.xlsm

  • Size

    6KB

  • MD5

    fb29c33662a5cb0c39d2e96907b963b3

  • SHA1

    851d394b9b76a4335a6bb0f239220db31e3c738e

  • SHA256

    d2b44e4232accfa49dd0169f0a0c16f2f65c613b2560529562821cf58edd4998

  • SHA512

    b67b18e9dfe5a5c388001f4b03a64936f02834736db4af3774c1d27d420eaba72de2b0ee3bd32983883b9ea2e2485b1cf2fb9bde345de9f738ba42a1c166c794

  • SSDEEP

    192:NDSIuSlUbrA2OmmfR+G8UhHFBFYu+Ab98yl1Yx+C0:NfuvM2wb1FYub98y7J

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://46.17.98.187/index.php

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fb29c33662a5cb0c39d2e96907b963b3.xlsm"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 3528
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:100
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 3528
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:4892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/100-29-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/100-37-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB

  • memory/100-38-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB

  • memory/100-39-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB

  • memory/100-40-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB

  • memory/100-41-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/100-42-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/100-25-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/100-27-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/100-28-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-9-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-10-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-13-0x00007FFD64770000-0x00007FFD64780000-memory.dmp

    Filesize

    64KB

  • memory/2724-15-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-17-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-20-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-19-0x00007FFD64770000-0x00007FFD64780000-memory.dmp

    Filesize

    64KB

  • memory/2724-18-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-16-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-14-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-12-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-11-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-8-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB

  • memory/2724-0-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB

  • memory/2724-5-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB

  • memory/2724-34-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-6-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-7-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-3-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB

  • memory/2724-4-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-2-0x00007FFDA6C30000-0x00007FFDA6E25000-memory.dmp

    Filesize

    2.0MB

  • memory/2724-1-0x00007FFD66CB0000-0x00007FFD66CC0000-memory.dmp

    Filesize

    64KB