Analysis

  • max time kernel
    144s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    28-02-2024 11:25

General

  • Target

    abc586ec16ff910d3d034f0488736823.xlsm

  • Size

    158KB

  • MD5

    abc586ec16ff910d3d034f0488736823

  • SHA1

    46ea3e04f2c7895d331d19e752fc67bdc8438b46

  • SHA256

    3d28e521ca329b68dc47d9d1d620c0e44fd5b50718cdad8f2c23008997668aed

  • SHA512

    c6ffafd02fd6bd2dd3483fb7d23e9096d108f02a0bc27b95a92d862154630d12e787b90d98dacaf240163cf38dca37300dc845c51df51d2984886c9bc0c14ef5

  • SSDEEP

    3072:LHlTkdm3bGeAxidxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKKNB:LFTkeGKdxVyWxfMU3liWA6FsYq

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://biopaten.no/xeBP8Oj5/gg.html

xlm40.dropper

https://beartoothkawasaki.com/QJT19jhtwHt/gg.html

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\abc586ec16ff910d3d034f0488736823.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2492
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 ..\cexyz1.dll
        2⤵
        • Process spawned unexpected child process
        PID:2596
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 ..\cexyz2.dll
        2⤵
        • Process spawned unexpected child process
        PID:2648

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1656-1-0x000000007266D000-0x0000000072678000-memory.dmp

      Filesize

      44KB

    • memory/1656-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1656-3-0x000000007266D000-0x0000000072678000-memory.dmp

      Filesize

      44KB