Analysis

  • max time kernel
    133s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:41

General

  • Target

    a468ba8981c2ffea9d4d3a0319fe71d110da71fa5f190b21ae52c331cf4bd503.xls

  • Size

    95KB

  • MD5

    922e580680b0af8e8630217f2e3a2cad

  • SHA1

    d1b51dbfb8274316380324c2427b9fb7509e29d5

  • SHA256

    a468ba8981c2ffea9d4d3a0319fe71d110da71fa5f190b21ae52c331cf4bd503

  • SHA512

    52570efaa344a0a0176f057e71295618b6f125c2857f8643062b058c4fd534453ea8c82bdc1f680985fa5246a3ab435cc692e73c1cea84eedfc30e21219a2142

  • SSDEEP

    1536:PFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCHuS4hcTO97v7UYdEJm0r:tKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgS

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.sunflowerlaboratory.in/fonts/79Tq62ly/

xlm40.dropper

http://dirigent.co.uk/vardagsekonomi/iC36jJ4J1cf/

xlm40.dropper

http://agtrade.hu/images/kiQYmOs2tSKq/

xlm40.dropper

https://www.zachboyle.com/wp-admin/EA470ZrTGNkuA/

Signatures

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a468ba8981c2ffea9d4d3a0319fe71d110da71fa5f190b21ae52c331cf4bd503.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci1.ocx
      2⤵
      • Process spawned unexpected child process
      PID:1368
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci2.ocx
      2⤵
      • Process spawned unexpected child process
      PID:1296
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci3.ocx
      2⤵
      • Process spawned unexpected child process
      PID:3788
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci4.ocx
      2⤵
      • Process spawned unexpected child process
      PID:516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    d1c0e641526a45383e4580fbcc5e8279

    SHA1

    e32cc47c88b717c247f3c9ba5511c84340318a97

    SHA256

    cedf60e622244d9df9995ca561d5ca955781e359010234cb823b165e822f4bcf

    SHA512

    95b0b0faea69a8b1370207ce0e48d2a8345b9d8a859d40745f4fcc3cca4bfffaa3e35195e0784c8ca5a7b723680549fdaba884609c10cd5e806fa56de0c7aa97

  • memory/3648-9-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-2-0x00007FFD9D3B0000-0x00007FFD9D3C0000-memory.dmp

    Filesize

    64KB

  • memory/3648-13-0x00007FFD9B0E0000-0x00007FFD9B0F0000-memory.dmp

    Filesize

    64KB

  • memory/3648-8-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-4-0x00007FFD9D3B0000-0x00007FFD9D3C0000-memory.dmp

    Filesize

    64KB

  • memory/3648-1-0x00007FFD9D3B0000-0x00007FFD9D3C0000-memory.dmp

    Filesize

    64KB

  • memory/3648-6-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-11-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-10-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-7-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-5-0x00007FFD9D3B0000-0x00007FFD9D3C0000-memory.dmp

    Filesize

    64KB

  • memory/3648-3-0x00007FFDDD3CD000-0x00007FFDDD3CE000-memory.dmp

    Filesize

    4KB

  • memory/3648-12-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-14-0x00007FFD9B0E0000-0x00007FFD9B0F0000-memory.dmp

    Filesize

    64KB

  • memory/3648-15-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-16-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-17-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-19-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-20-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-18-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-21-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-37-0x00007FFDDD330000-0x00007FFDDD525000-memory.dmp

    Filesize

    2.0MB

  • memory/3648-0-0x00007FFD9D3B0000-0x00007FFD9D3C0000-memory.dmp

    Filesize

    64KB