Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 17:45
Behavioral task
behavioral1
Sample
b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f.xlsm
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f.xlsm
Resource
win10v2004-20241007-en
General
-
Target
b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f.xlsm
-
Size
46KB
-
MD5
8e743641a4ec5482dbb19c4a393ffcde
-
SHA1
6f1f66582f94659b25f50be1d51240635418001a
-
SHA256
b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f
-
SHA512
73cad643fd916f9018ce7ced44897ec6007e0847ff3b3e452b8b7f81882f81ac686f06eccbb9d5fa34f96137e624378ab500e630e9e11447406936e3a6c86534
-
SSDEEP
768:KyMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:jMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk
Malware Config
Extracted
http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/
https://baksen.org/chat/8wYoYwWXH4eidiUOAs/
https://truetvkerala.com/wp-admin/iocOOm7I/
https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/
http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/
http://restoran.hotelrestoranaqua.com/wp-includes/67I/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 652 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 652 EXCEL.EXE 652 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 652 EXCEL.EXE 652 EXCEL.EXE 652 EXCEL.EXE 652 EXCEL.EXE 652 EXCEL.EXE 652 EXCEL.EXE 652 EXCEL.EXE 652 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD56bb1a8ae90b0fc226f57fd112c1bd240
SHA18807e295a6f7269d9839d67a767eee5768af6e46
SHA25663b9737070860098faec1d5265def69acd531d5d950da9563b5fc03dfd1a33d7
SHA51254c9126ec73f574b8f59bf736059029672c489f17540dbcbea11575b44450456d3e755672fbdba818dfb2cdf69e557f4258049a42dd97ceff255bc4fbf0e8c5b