Analysis

  • max time kernel
    133s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:43

General

  • Target

    da1f2ac43decbffad516810fd43e97405929bcb3a64ba01df9d53e55c2499d26.xlsm

  • Size

    20KB

  • MD5

    4351075c0a992c00a3603d09b55366f2

  • SHA1

    8ae2ae83f3c7dcce19052c127d50183784ad8b29

  • SHA256

    da1f2ac43decbffad516810fd43e97405929bcb3a64ba01df9d53e55c2499d26

  • SHA512

    ea5da66e80e475103752e5566aba6a1c6f204c076e5834cd29eb1e29e3d87ef9bba1d06e7f2f72ee84de06f1c7a98f89ae3acf029808ea93b024c6750a4a3d25

  • SSDEEP

    384:iQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:iTINqTo4FL3CBn9kC+xbLHjj

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.bridgewien.at/admin/9Osvbo9caA4QYishnWka/

xlm40.dropper

http://bartboutens.nl/cgi-bin/aPqSkCZXI3ueRdI/

xlm40.dropper

http://aleph.org.ng/wp-includes/k8YwVWkrdmUM9/

xlm40.dropper

http://alkautsarlampung.sch.id/belajar/WQlNleMJKoulGBUvgC9/

xlm40.dropper

http://automyjniafordon.bydgoszcz.pl/123/mOWZgMaL/

xlm40.dropper

http://www.annuncisiciliani.it/app/3l1ZgVfwIEiIcGelh/

xlm40.dropper

http://autoat.mx/assets/VljikBuT029PkSBfrc/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\da1f2ac43decbffad516810fd43e97405929bcb3a64ba01df9d53e55c2499d26.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    bb72075e74aa1944d2cb69abe9d3d15f

    SHA1

    b09e76264827a5a5f0c5ee7bb4b6636f7edea610

    SHA256

    093e04e40bfa3e25b601c40ffe2750919ca1af340f8f5e1a3b8bb6f85cfee680

    SHA512

    97cdae33782be41a7f34b147e64035a24394dc539ff62cb49c32625efab90fa35347ad1019ae192d1f64dcb46845d2efcc42e0d79e142c1a243483ebedcb12a8

  • memory/3308-11-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-44-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-4-0x00007FF836CB0000-0x00007FF836CC0000-memory.dmp

    Filesize

    64KB

  • memory/3308-1-0x00007FF876CCD000-0x00007FF876CCE000-memory.dmp

    Filesize

    4KB

  • memory/3308-6-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-8-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-7-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-10-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-3-0x00007FF836CB0000-0x00007FF836CC0000-memory.dmp

    Filesize

    64KB

  • memory/3308-2-0x00007FF836CB0000-0x00007FF836CC0000-memory.dmp

    Filesize

    64KB

  • memory/3308-9-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-12-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-13-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-14-0x00007FF834AD0000-0x00007FF834AE0000-memory.dmp

    Filesize

    64KB

  • memory/3308-15-0x00007FF834AD0000-0x00007FF834AE0000-memory.dmp

    Filesize

    64KB

  • memory/3308-42-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-43-0x00007FF876CCD000-0x00007FF876CCE000-memory.dmp

    Filesize

    4KB

  • memory/3308-0-0x00007FF836CB0000-0x00007FF836CC0000-memory.dmp

    Filesize

    64KB

  • memory/3308-52-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

    Filesize

    2.0MB

  • memory/3308-5-0x00007FF836CB0000-0x00007FF836CC0000-memory.dmp

    Filesize

    64KB