Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 17:41
Behavioral task
behavioral1
Sample
eb1b1f24745953db908595cd2b1854cd5c6e62356319b61e43bc7f0714f8ab0d.xlsm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
eb1b1f24745953db908595cd2b1854cd5c6e62356319b61e43bc7f0714f8ab0d.xlsm
Resource
win10v2004-20241007-en
General
-
Target
eb1b1f24745953db908595cd2b1854cd5c6e62356319b61e43bc7f0714f8ab0d.xlsm
-
Size
35KB
-
MD5
1909a5fa37d26c68daf7d52c0a22d351
-
SHA1
228669309cbcbecd913acbe657858908d3fda9af
-
SHA256
eb1b1f24745953db908595cd2b1854cd5c6e62356319b61e43bc7f0714f8ab0d
-
SHA512
7d0b66ff4f1eaff10b50ebd1a54e6dd0a1c04477d077d01c401fdf7e57cac70cda50a6a7f6574b794e3d0ecc908e17debded45590840db7e7d2b41372009c56b
-
SSDEEP
768:aYKtm5eMn7AjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooXLR:aYKtmg+UOZZ1ZYpoQ/pMAm
Malware Config
Extracted
https://casinojackpotking.com/cgi-bin/47sKbklSQf31/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1276 1968 regsvr32.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1968 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1968 EXCEL.EXE 1968 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE 1968 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1276 1968 EXCEL.EXE 96 PID 1968 wrote to memory of 1276 1968 EXCEL.EXE 96 PID 1968 wrote to memory of 1276 1968 EXCEL.EXE 96
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eb1b1f24745953db908595cd2b1854cd5c6e62356319b61e43bc7f0714f8ab0d.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:1276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD517b851c2122eac380135453d86afb6a6
SHA188b335ff55d23ea78f636db90021a2611a9cc3a0
SHA2568d164e87eb866dedd32a3691f49b92b5059639542eb777558e5095bf0a6ac74f
SHA51288f727ffa8560e2c48d0c90522c1b194562f788d21a6177d8bc9fbc893288e3f9911a7230ea94f8d23b6230b60596207e397c85b08586dc86f54677d64b4143a
-
Filesize
9B
MD59d1ead73e678fa2f51a70a933b0bf017
SHA1d205cbd6783332a212c5ae92d73c77178c2d2f28
SHA2560019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
SHA512935b3d516e996f6d25948ba8a54c1b7f70f7f0e3f517e36481fdf0196c2c5cfc2841f86e891f3df9517746b7fb605db47cdded1b8ff78d9482ddaa621db43a34