Analysis

  • max time kernel
    133s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:28

General

  • Target

    07dfe93ac6e4f698ad0d7ee7e9242912dc9f84de665d689c111a864b882f3a53.xls

  • Size

    40KB

  • MD5

    30408f831a941fb0d0bc8581a904a22c

  • SHA1

    f6d2be1e3600bc6a23a670e67820d5c90b478e58

  • SHA256

    07dfe93ac6e4f698ad0d7ee7e9242912dc9f84de665d689c111a864b882f3a53

  • SHA512

    f328a266b4cbffbf64a5bbb3856efb3f95ba0fbc6b43f3257e3d786335661d58e825296aea067134f4c2dbaacbc221f3ec1319097ffbdc0ea49c3ab2679aa6b0

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgACCBn9kC+xbwcZfqG9tMvcVi1lc:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dk

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://easiercommunications.com/wp-content/w/

xlm40.dropper

http://dulichdichvu.net/libraries/QhtrjCZymLp5EbqOdpKk/

xlm40.dropper

https://www.whow.fr/wp-includes/H54Fgj0tG/

xlm40.dropper

http://genccagdas.com.tr/assets/TTHOm833iNn3BxT/

xlm40.dropper

http://heaventechnologies.com.pk/apitest/xdeAU0rx26LT9I/

xlm40.dropper

http://goonboy.com/goonie/bSFz7Av/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\07dfe93ac6e4f698ad0d7ee7e9242912dc9f84de665d689c111a864b882f3a53.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe ..\wurod.ocx
      2⤵
      • Process spawned unexpected child process
      PID:844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    1b79013327b896979843341fc960e4c8

    SHA1

    e48f970498e46260fb6fb58fe334dfa3e808ca44

    SHA256

    55f631ad61cf3b20a77f2ea53e4f7604c63261b2c682779dd3bb91e39c2f7014

    SHA512

    6947c8d86a96950b228c31f928285772ddedd62c35a8816f860161f3fdc6d0bd33f2cd5e3730eae7aadfe5f290f8b3fccb89c5875e367dc6b6362696f5b38045

  • C:\Users\Admin\wurod.ocx

    Filesize

    7KB

    MD5

    797e94343f2bd6d4cdea65cc8b1fdf00

    SHA1

    ad3aa4de0584f6e92e2cf571bc02eb4a8138ba66

    SHA256

    168c6189f01359d4d46c94a1681c214403f530d0c6d643154bc530b5e947407e

    SHA512

    92302d8b4e0c1ec95efafaf33c0e3248a4a071284691cf9b3d96d6f380ed668798cfda620a7389a76c9f1df07c25dd53d32cc26623f27f176f03f8b4eb8498d3

  • memory/2896-13-0x00007FFECA190000-0x00007FFECA1A0000-memory.dmp

    Filesize

    64KB

  • memory/2896-15-0x00007FFECA190000-0x00007FFECA1A0000-memory.dmp

    Filesize

    64KB

  • memory/2896-3-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

    Filesize

    64KB

  • memory/2896-8-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

    Filesize

    64KB

  • memory/2896-7-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-9-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-10-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-12-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-0-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

    Filesize

    64KB

  • memory/2896-11-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-14-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-4-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-17-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-16-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-6-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

    Filesize

    64KB

  • memory/2896-2-0x00007FFECC4B0000-0x00007FFECC4C0000-memory.dmp

    Filesize

    64KB

  • memory/2896-27-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-28-0x00007FFF0C4CD000-0x00007FFF0C4CE000-memory.dmp

    Filesize

    4KB

  • memory/2896-29-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-5-0x00007FFF0C430000-0x00007FFF0C625000-memory.dmp

    Filesize

    2.0MB

  • memory/2896-1-0x00007FFF0C4CD000-0x00007FFF0C4CE000-memory.dmp

    Filesize

    4KB