Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 17:27
Behavioral task
behavioral1
Sample
43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95.xlsm
Resource
win10v2004-20241007-en
General
-
Target
43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95.xlsm
-
Size
37KB
-
MD5
045dea3391a8f717161c5905ec0cae2c
-
SHA1
c655ba8c08a324bec52d70f63940283876c31b89
-
SHA256
43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95
-
SHA512
d3e4bafe26fb6f427bb041f1c1077b44b6a034d6a8a20280859ffb813bfaa11fb4f6596a215424e435f75b6123b240d0828deb98ec9494d1e9ebc26c2cde758f
-
SSDEEP
768:kb/Mvd5dhTJxmxE7l0VGpevZCw4VmUxjfC30+kS4QyoX0VyY5G:kbmd5zmxE7W0XYk4pEVyV
Malware Config
Extracted
https://ordereasy.hk/error/8BZswf/
https://duocphamct.com/wp-content/JYT0KrYcoJrAj/
https://test.ohmyhome.com/licenses/W/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5104 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5104 EXCEL.EXE 5104 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5104 EXCEL.EXE 5104 EXCEL.EXE 5104 EXCEL.EXE 5104 EXCEL.EXE 5104 EXCEL.EXE 5104 EXCEL.EXE 5104 EXCEL.EXE 5104 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\43ef44fa0807cffa51e5f2b9a970a27602001b3573d845490bdceeda9b0cff95.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize4KB
MD534630a08f18b5a3f19e01802db75bb0e
SHA1c2eb0794895737857e07d61889bae1fb2ff4ffa2
SHA256959ff0093f7ef9d0451d3de511ea3a91779590e2f12d6c46fdac6aed929e937d
SHA512d8e9238a5f87246b5d71a5952704d4e4c98f9f33e2671746d62ea8561cc2d6323383ac144f1e7516c8e21ce1cd2831270f29a22989926b84dbd2151c3be335cf