Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-02-2024 11:25

General

  • Target

    abc586ec16ff910d3d034f0488736823.xlsm

  • Size

    158KB

  • MD5

    abc586ec16ff910d3d034f0488736823

  • SHA1

    46ea3e04f2c7895d331d19e752fc67bdc8438b46

  • SHA256

    3d28e521ca329b68dc47d9d1d620c0e44fd5b50718cdad8f2c23008997668aed

  • SHA512

    c6ffafd02fd6bd2dd3483fb7d23e9096d108f02a0bc27b95a92d862154630d12e787b90d98dacaf240163cf38dca37300dc845c51df51d2984886c9bc0c14ef5

  • SSDEEP

    3072:LHlTkdm3bGeAxidxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKKNB:LFTkeGKdxVyWxfMU3liWA6FsYq

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://biopaten.no/xeBP8Oj5/gg.html

xlm40.dropper

https://beartoothkawasaki.com/QJT19jhtwHt/gg.html

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\abc586ec16ff910d3d034f0488736823.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2288
      • C:\Windows\SYSTEM32\regsvr32.exe
        regsvr32 ..\cexyz1.dll
        2⤵
        • Process spawned unexpected child process
        PID:548
      • C:\Windows\SYSTEM32\regsvr32.exe
        regsvr32 ..\cexyz2.dll
        2⤵
        • Process spawned unexpected child process
        PID:2660
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:1768

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2404-0-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

        Filesize

        64KB

      • memory/2404-3-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

        Filesize

        64KB

      • memory/2404-2-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-5-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-6-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

        Filesize

        64KB

      • memory/2404-7-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-4-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

        Filesize

        64KB

      • memory/2404-1-0x00007FFC29450000-0x00007FFC29460000-memory.dmp

        Filesize

        64KB

      • memory/2404-8-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-9-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-11-0x00007FFC26E40000-0x00007FFC26E50000-memory.dmp

        Filesize

        64KB

      • memory/2404-12-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-10-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-13-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-14-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-15-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-16-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-17-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-18-0x00007FFC26E40000-0x00007FFC26E50000-memory.dmp

        Filesize

        64KB

      • memory/2404-20-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-21-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-19-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-34-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2404-37-0x00007FFC693D0000-0x00007FFC695C5000-memory.dmp

        Filesize

        2.0MB