Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 17:27
Behavioral task
behavioral1
Sample
43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95.xlsm
Resource
win10v2004-20241007-en
General
-
Target
43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95.xlsm
-
Size
37KB
-
MD5
045dea3391a8f717161c5905ec0cae2c
-
SHA1
c655ba8c08a324bec52d70f63940283876c31b89
-
SHA256
43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95
-
SHA512
d3e4bafe26fb6f427bb041f1c1077b44b6a034d6a8a20280859ffb813bfaa11fb4f6596a215424e435f75b6123b240d0828deb98ec9494d1e9ebc26c2cde758f
-
SSDEEP
768:kb/Mvd5dhTJxmxE7l0VGpevZCw4VmUxjfC30+kS4QyoX0VyY5G:kbmd5zmxE7W0XYk4pEVyV
Malware Config
Extracted
https://ordereasy.hk/error/8BZswf/
https://duocphamct.com/wp-content/JYT0KrYcoJrAj/
https://test.ohmyhome.com/licenses/W/
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2760 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2760 EXCEL.EXE 2760 EXCEL.EXE 2760 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2760