Resubmissions
29/08/2024, 02:50
240829-db2mpszfrb729/08/2024, 02:49
240829-da6j9ssbjk729/08/2024, 02:12
240829-cncnnsydna10Analysis
- max time kernel
299s - max time network
299s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
29/08/2024, 02:50
General
- Target SWIFT COPY.xls
- Size 536KB
- Sample240829-db2mpszfrb
- SHA256 33ac27d5d62b88cda7ee122abcd3209306e9527ab0b9dea5633572d8f3908bdd
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
103621DE9CD5414CC2538780B4B75751
7E8BDF27898FD04B591B0B0011B10808
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
103621DE9CD5414CC2538780B4B75751
7E8BDF27898FD04B591B0B0011B10808
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
A7BBEB3A-CBCD-4671-A274-56C2444D2951
mip_sdk.miplog
74a0ad00a184813f0b8867eb2f8dfef7227a18a4.tbres
sreemanganshekumarsayingbuttersmoothbunneverhandlingthesweetmilkbunwhichreallytastywithbuttersmooththings_________getitsbacktotheroadwith[1].doc
gb.xsl
index.dat
fb3b0dbfee58fac8.customDestinations-ms
fb3b0dbfee58fac8.customDestinations-ms
memory/2768-13-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-1-0x00007FFD1DA55000-0x00007FFD1DA56000-memory.dmp
memory/2768-18-0x00007FFCDAEF0000-0x00007FFCDAF00000-memory.dmp
memory/2768-17-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-12-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-21-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-22-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-24-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-23-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-20-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-16-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-15-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-14-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-19-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-11-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-10-0x00007FFCDAEF0000-0x00007FFCDAF00000-memory.dmp
memory/2768-9-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-8-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-299-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-300-0x00007FFD1DA55000-0x00007FFD1DA56000-memory.dmp
memory/2768-301-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-307-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-5-0x00007FFCDDA40000-0x00007FFCDDA50000-memory.dmp
memory/2768-2-0x00007FFCDDA40000-0x00007FFCDDA50000-memory.dmp
memory/2768-3-0x00007FFCDDA40000-0x00007FFCDDA50000-memory.dmp
memory/2768-4-0x00007FFD1D9B0000-0x00007FFD1DB8B000-memory.dmp
memory/2768-0-0x00007FFCDDA40000-0x00007FFCDDA50000-memory.dmp