Overview

overview

10

Static

static

1

CUML.xlsx

windows7-x64

1

CUML.xlsx

windows10-2004-x64

10

Resubmissions

15/02/2024, 22:27

240215-2c66ksba54 1

14/02/2024, 20:38

240214-ze6xgsbb3z 1

14/02/2024, 16:48

240214-vbddjsgh42 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    CUML.xlsx

  • Size

    56KB

  • Sample

    240214-vbddjsgh42

  • MD5

    a8b505f9e18fc6faf320db708828e7f9

  • SHA1

    e24903290b0dddfb2b4411096e26a591f6d6ed2f

  • SHA256

    9d6ff63ac594a5c47c0b7ab6e2a871dba07c18fb9f6e7b844f79a22af3bb59ed

  • SHA512

    1dd4ef89d9af135aadd7f2bbcab00da7b6d72c5186f53b37e0f2c58c626cb2f873868e5ef6f257ffb3b95f582a7296bbeaf1b93b716783014f7e07621e6594cd

  • SSDEEP

    1536:mAToOEjzAw7Y2r7DUsV4XzY9t3jSagJYw8TE3JnK:FoOAcw7nXDUsOjm3jTxY1K

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      CUML.xlsx

    • Size

      56KB

    • MD5

      a8b505f9e18fc6faf320db708828e7f9

    • SHA1

      e24903290b0dddfb2b4411096e26a591f6d6ed2f

    • SHA256

      9d6ff63ac594a5c47c0b7ab6e2a871dba07c18fb9f6e7b844f79a22af3bb59ed

    • SHA512

      1dd4ef89d9af135aadd7f2bbcab00da7b6d72c5186f53b37e0f2c58c626cb2f873868e5ef6f257ffb3b95f582a7296bbeaf1b93b716783014f7e07621e6594cd

    • SSDEEP

      1536:mAToOEjzAw7Y2r7DUsV4XzY9t3jSagJYw8TE3JnK:FoOAcw7nXDUsOjm3jTxY1K

    Score
    10/10
    discoverypersistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks