Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 11:12
General
-
Target
d36ad05aac6706eaec73632a797b4c6833e3ea1f9b607ac0801637670550e0db.xlsm
-
Size
46KB
-
MD5
927be3c113bdce59bdd341c6cfaee7a0
-
SHA1
8c296975cb618bda1e4d86f6592581341539bd9b
-
SHA256
d36ad05aac6706eaec73632a797b4c6833e3ea1f9b607ac0801637670550e0db
-
SHA512
898cd33df2827612c8561e0fa788dc8f9351c59de4bbb209337cc2e48a91067f454338973841d0f490bf5f9abbf382c7d2efc5e085759b4ea18586cb4eceb3f2
-
SSDEEP
768:2o9DOevZCwrvtOzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPPDks:2o9D+tT5fTR4Lh1NisFYBc3cr+UqVnDZ
Malware Config
Extracted
http://dan-bau.com/wp-includes/css/dist/h2plh7xZso/
https://advisereviews.com/wp-content/2NyZZiJ6KEzPPrbx/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d36ad05aac6706eaec73632a797b4c6833e3ea1f9b607ac0801637670550e0db.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d4b23fbedc3e7a8bc977a690e2cf14a4
SHA1a0f6765671aa4549fcec7b94a63c26d9669a0d6b
SHA256d160f4951329c1a8f8537c7572e91710368c7b361a420bff5fe973ba0081b591
SHA5129e6185fd8ada06fc08abff7280fdf0de9e709928405cce7062ea70b5d0e6b87dac3693ef8da78384da1b4f93dbc7fde9404673a2a4790b04cdb66a6b5dace75c
-
Filesize
1KB
MD51326c16a18441423830933fbb3a6a290
SHA1d62b5f0ec9ae7a82209938c347311519b9fc1084
SHA2563bb40456027c77d05b991e4686f10e51739a6ebdca3e33ec5edcd1e2c28b34cf
SHA5122b9076d43ccc836c89bcd4cc1946008b1d0268edf432d37659960f4ffb9836ca65e638b61305f374ba71b2fa21ac3210482c0e6287288e75bcd44d4fbeb3e528
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB