Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:45

General

  • Target

    b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f.xlsm

  • Size

    46KB

  • MD5

    8e743641a4ec5482dbb19c4a393ffcde

  • SHA1

    6f1f66582f94659b25f50be1d51240635418001a

  • SHA256

    b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f

  • SHA512

    73cad643fd916f9018ce7ced44897ec6007e0847ff3b3e452b8b7f81882f81ac686f06eccbb9d5fa34f96137e624378ab500e630e9e11447406936e3a6c86534

  • SSDEEP

    768:KyMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:jMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/

xlm40.dropper

https://baksen.org/chat/8wYoYwWXH4eidiUOAs/

xlm40.dropper

https://truetvkerala.com/wp-admin/iocOOm7I/

xlm40.dropper

https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/

xlm40.dropper

http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/

xlm40.dropper

http://restoran.hotelrestoranaqua.com/wp-includes/67I/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    6bb1a8ae90b0fc226f57fd112c1bd240

    SHA1

    8807e295a6f7269d9839d67a767eee5768af6e46

    SHA256

    63b9737070860098faec1d5265def69acd531d5d950da9563b5fc03dfd1a33d7

    SHA512

    54c9126ec73f574b8f59bf736059029672c489f17540dbcbea11575b44450456d3e755672fbdba818dfb2cdf69e557f4258049a42dd97ceff255bc4fbf0e8c5b

  • memory/652-12-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-6-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-15-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-17-0x00007FF844410000-0x00007FF844420000-memory.dmp

    Filesize

    64KB

  • memory/652-16-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-5-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-10-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-13-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-14-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-2-0x00007FF88648D000-0x00007FF88648E000-memory.dmp

    Filesize

    4KB

  • memory/652-0-0x00007FF846470000-0x00007FF846480000-memory.dmp

    Filesize

    64KB

  • memory/652-4-0x00007FF846470000-0x00007FF846480000-memory.dmp

    Filesize

    64KB

  • memory/652-1-0x00007FF846470000-0x00007FF846480000-memory.dmp

    Filesize

    64KB

  • memory/652-11-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-18-0x00007FF844410000-0x00007FF844420000-memory.dmp

    Filesize

    64KB

  • memory/652-9-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-8-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-7-0x00007FF846470000-0x00007FF846480000-memory.dmp

    Filesize

    64KB

  • memory/652-31-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-32-0x00007FF8863F0000-0x00007FF8865E5000-memory.dmp

    Filesize

    2.0MB

  • memory/652-3-0x00007FF846470000-0x00007FF846480000-memory.dmp

    Filesize

    64KB