Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:31

General

  • Target

    1d2ab188d3607f59898f5d4d80135e2881b3bfad44cfa6657ab5d1b013dd0000.xlsm

  • Size

    45KB

  • MD5

    8574d3556d2265e288213c80de56fc57

  • SHA1

    f020d7e9fb20d417673777aa64f496ea7efd050d

  • SHA256

    1d2ab188d3607f59898f5d4d80135e2881b3bfad44cfa6657ab5d1b013dd0000

  • SHA512

    ab3400f79f2b05c5c7cdbb137ac9983a96434e2166edd129621b1980a5b0612356e0f5596134b527f7d90794afa3c71d6dc29dc1814fcca35aaefbf017d84e33

  • SSDEEP

    768:GqLrVo43DOevZCwrvtZmzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2tCo:NrVo43DwtT5fTR4Lh1NisFYBc3cr+U2T

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://piajimenez.com/Fox-C/dS4nv3spYd0DZsnwLqov/

xlm40.dropper

http://inopra.com/wp-includes/3zGnQGNCvIKuvrO7T/

xlm40.dropper

http://biomedicalpharmaegypt.com/sapbush/BKEaVq1zoyJssmUoe/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1d2ab188d3607f59898f5d4d80135e2881b3bfad44cfa6657ab5d1b013dd0000.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    686B

    MD5

    1596e69cda1f3822feca56281a99c6f5

    SHA1

    06ece1a02a2b963aa00057ff2910057db3be779c

    SHA256

    16bc4542aafd5a6d502470f314790f4d66061a42c7fee1e0c162134e6883b8fa

    SHA512

    2ff9edae8d63e83adcf93d7dafc021775901c4c2d10b8bc91c096bb03aa964759819adfc55e22159b3552aa5a6bc423350691e5307f452b7733c8eceb4cd9e6b

  • C:\Users\Admin\enu.ocx

    Filesize

    7KB

    MD5

    b996dfb94ee763ad91a6e1034b455635

    SHA1

    daf76e3be885af694649efe720e146bde68d4e3b

    SHA256

    66e867b341ea1836bf112f4a7232b7c72e9330d2fe3ba3b2adf4ac8ad143d9ee

    SHA512

    d2a48820cdf0d0edf757222047c06e5859f801dcbc26aff8cafae67c72c3a06ab297dfa58ad9ebe677441b581feb3bb53833ffda5882886f75222a1773a41aa5

  • memory/4552-8-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-4-0x00007FFB03C50000-0x00007FFB03C60000-memory.dmp

    Filesize

    64KB

  • memory/4552-15-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-5-0x00007FFB03C50000-0x00007FFB03C60000-memory.dmp

    Filesize

    64KB

  • memory/4552-0-0x00007FFB03C50000-0x00007FFB03C60000-memory.dmp

    Filesize

    64KB

  • memory/4552-11-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-10-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-9-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-17-0x00007FFB01340000-0x00007FFB01350000-memory.dmp

    Filesize

    64KB

  • memory/4552-12-0x00007FFB01340000-0x00007FFB01350000-memory.dmp

    Filesize

    64KB

  • memory/4552-2-0x00007FFB03C50000-0x00007FFB03C60000-memory.dmp

    Filesize

    64KB

  • memory/4552-3-0x00007FFB03C50000-0x00007FFB03C60000-memory.dmp

    Filesize

    64KB

  • memory/4552-7-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-16-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-14-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-13-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-1-0x00007FFB43C6D000-0x00007FFB43C6E000-memory.dmp

    Filesize

    4KB

  • memory/4552-33-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-34-0x00007FFB43C6D000-0x00007FFB43C6E000-memory.dmp

    Filesize

    4KB

  • memory/4552-35-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-36-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB

  • memory/4552-6-0x00007FFB43BD0000-0x00007FFB43DC5000-memory.dmp

    Filesize

    2.0MB