Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 17:39
Behavioral task
behavioral1
Sample
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef.xlsm
Resource
win10v2004-20241007-en
General
-
Target
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef.xlsm
-
Size
50KB
-
MD5
611407dcaa57d04ec45453e06fbc4a51
-
SHA1
645766461e57479ca19a1665b47d9755c6934907
-
SHA256
f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef
-
SHA512
682968c4139b2e084b74674c3e52cac1120df6a95181bbe149ac0f43d8057e804c7eb5c86ae5d5694891cfca6803aa8bb5884bc6fbdaf4ac6bef0f6f2542753c
-
SSDEEP
768:2x9D9onkH+lSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0Zl:2XD9oencDSmSIBlGeuSEcm2h0BZl
Malware Config
Extracted
http://actividades.laforetlanguages.com/wp-admin/WQNAwrWi77MV8a05fia/
http://consejosdeorlando.com/wp-includes/mMaIlj99Y1C1sYN/
http://aopda.org/wp-content/uploads/KXc3Agu18w/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2196 2116 regsvr32.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2116 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2116 EXCEL.EXE 2116 EXCEL.EXE 2116 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2196 2116 EXCEL.EXE 30 PID 2116 wrote to memory of 2196 2116 EXCEL.EXE 30 PID 2116 wrote to memory of 2196 2116 EXCEL.EXE 30 PID 2116 wrote to memory of 2196 2116 EXCEL.EXE 30 PID 2116 wrote to memory of 2196 2116 EXCEL.EXE 30 PID 2116 wrote to memory of 2196 2116 EXCEL.EXE 30 PID 2116 wrote to memory of 2196 2116 EXCEL.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\f2223b7534d284126d4d65020d68a461d8b6574be12695a9e767f566d67301ef.xlsm1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\en.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57ca8b408e0da8ea1f3ecf99442e7cd8f
SHA1b24f247853a32ddca60add502d0fabb4722a7263
SHA2565db767b3bb72a45376e08229480adcbe97b19a723714e359745160d38ed774a2
SHA512a5b25779e872a17f0b78a33dcd3e22c4bd3a8c5e0665ba14d529a17e433a3fa95cf407219dbdf48dd1b2d34e1fe1df8c3f4633188687c69bee7df2db6f7565a7