Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 17:34
Behavioral task
behavioral1
Sample
2b6a7f6001fcd7f82e550a6f1578c2986774a79c204631dae2b90f784e76470e.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2b6a7f6001fcd7f82e550a6f1578c2986774a79c204631dae2b90f784e76470e.xls
Resource
win10v2004-20241007-en
General
-
Target
2b6a7f6001fcd7f82e550a6f1578c2986774a79c204631dae2b90f784e76470e.xls
-
Size
53KB
-
MD5
4986eb9a2c14be2320c661ff92a3568d
-
SHA1
4947172d9298bd6d1157bae521d1b4f7fa083319
-
SHA256
2b6a7f6001fcd7f82e550a6f1578c2986774a79c204631dae2b90f784e76470e
-
SHA512
9d307450ae89b53400cd23e7479d93d9bcc54bf2905e9d7a291a0631a766fad7811a3c44b4e2ec89618e83c34b3cf1dbb2ed50090422cea682d5a5ae4b68c8d1
-
SSDEEP
1536:LPKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+bSgNeEYL8ECyH:rKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMt
Malware Config
Extracted
https://newkano.com/wp-admin/66rIsrVwoPKUsjcAs/
http://ocalogullari.com/inc/Wcm82enrs8/
https://myphamcuatui.com/assets/OPVeVSpO/
http://sieuthiphutungxenang.com/old_source/9boJQZpTSdQE/
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 728 3272 regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 932 3272 regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2008 3272 regsvr32.exe 82 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3216 3272 regsvr32.exe 82 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3272 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3272 EXCEL.EXE 3272 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3272 wrote to memory of 728 3272 EXCEL.EXE 93 PID 3272 wrote to memory of 728 3272 EXCEL.EXE 93 PID 3272 wrote to memory of 932 3272 EXCEL.EXE 94 PID 3272 wrote to memory of 932 3272 EXCEL.EXE 94 PID 3272 wrote to memory of 2008 3272 EXCEL.EXE 96 PID 3272 wrote to memory of 2008 3272 EXCEL.EXE 96 PID 3272 wrote to memory of 3216 3272 EXCEL.EXE 99 PID 3272 wrote to memory of 3216 3272 EXCEL.EXE 99
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2b6a7f6001fcd7f82e550a6f1578c2986774a79c204631dae2b90f784e76470e.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\cusoa1.ocx2⤵
- Process spawned unexpected child process
PID:728
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\cusoa2.ocx2⤵
- Process spawned unexpected child process
PID:932
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\cusoa3.ocx2⤵
- Process spawned unexpected child process
PID:2008
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\cusoa4.ocx2⤵
- Process spawned unexpected child process
PID:3216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD598801816ff19e095e3868e9f862530be
SHA194974ab368bf4e7ffd38be015c10846a8baa4320
SHA25615108434f317680078eb2f3d29cd4af69c3e2499177377decb9dc0c05f3f870e
SHA512172ee54913ecfaa4ff2d19840b53ddaf6d5768264fcd25971febe58a65ce86b07ada989804ddc00cffa77dad0ceacd37c5e90406aae539fdc84d06ad205046a7