Analysis

  • max time kernel
    133s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:43

General

  • Target

    850b3713775d46c3ec62ffac19845fc1b56a3dfa2d43983462529610ab7da3a3.xlsm

  • Size

    20KB

  • MD5

    194c0d2ce97bf7b001fc463b4530e348

  • SHA1

    5ff8ba61c215439db850639aeef4d83eb1624f69

  • SHA256

    850b3713775d46c3ec62ffac19845fc1b56a3dfa2d43983462529610ab7da3a3

  • SHA512

    214ad9a54a884c8f85c5cd657806071a229e330fff69db56e02a3b7dd8c121d08507b704cbb316f1c7c4aea9765800c1c1431129bd1b2a7277917676536d3a77

  • SSDEEP

    384:2QZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:2TINqTo4FL3CBn9kC+xbLHjj

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.bridgewien.at/admin/9Osvbo9caA4QYishnWka/

xlm40.dropper

http://bartboutens.nl/cgi-bin/aPqSkCZXI3ueRdI/

xlm40.dropper

http://aleph.org.ng/wp-includes/k8YwVWkrdmUM9/

xlm40.dropper

http://alkautsarlampung.sch.id/belajar/WQlNleMJKoulGBUvgC9/

xlm40.dropper

http://automyjniafordon.bydgoszcz.pl/123/mOWZgMaL/

xlm40.dropper

http://www.annuncisiciliani.it/app/3l1ZgVfwIEiIcGelh/

xlm40.dropper

http://autoat.mx/assets/VljikBuT029PkSBfrc/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\850b3713775d46c3ec62ffac19845fc1b56a3dfa2d43983462529610ab7da3a3.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    2d48176d88f4853cd98da6706c7abf4f

    SHA1

    e21328ada212ac9d859131ecc60254bf669a387e

    SHA256

    7b5d2b747af9e9f6e2288c94a7ba717c416c3cd0faa981d387958edf3405d9c9

    SHA512

    8605f19b12233c4a715f8a89930117d74e1a4f723474c6aa559c05767fb1da8b11c3a9e2a599be322278aeaffeea39936af404bdbd130e0e6dc83409144581ee

  • memory/4032-15-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-1-0x00007FF9EE8F0000-0x00007FF9EE900000-memory.dmp

    Filesize

    64KB

  • memory/4032-4-0x00007FF9EE8F0000-0x00007FF9EE900000-memory.dmp

    Filesize

    64KB

  • memory/4032-8-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-7-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-9-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-6-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-11-0x00007FF9EBF90000-0x00007FF9EBFA0000-memory.dmp

    Filesize

    64KB

  • memory/4032-10-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-13-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-3-0x00007FFA2E90D000-0x00007FFA2E90E000-memory.dmp

    Filesize

    4KB

  • memory/4032-2-0x00007FF9EE8F0000-0x00007FF9EE900000-memory.dmp

    Filesize

    64KB

  • memory/4032-17-0x00007FF9EBF90000-0x00007FF9EBFA0000-memory.dmp

    Filesize

    64KB

  • memory/4032-18-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-16-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-20-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-19-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-22-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-21-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-14-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-5-0x00007FF9EE8F0000-0x00007FF9EE900000-memory.dmp

    Filesize

    64KB

  • memory/4032-0-0x00007FF9EE8F0000-0x00007FF9EE900000-memory.dmp

    Filesize

    64KB

  • memory/4032-57-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB

  • memory/4032-12-0x00007FFA2E870000-0x00007FFA2EA65000-memory.dmp

    Filesize

    2.0MB