Analysis
-
max time kernel
133s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 11:20
General
-
Target
8fc638fb4ed752cddfef675fe0bfe4d4f8cab13d3c78ef905f4cea1beb49c8e1.xlsm
-
Size
46KB
-
MD5
ba0a7ea3d915f993337be075371e4cb5
-
SHA1
0729ded134149a402fa558ced8579f866d461623
-
SHA256
8fc638fb4ed752cddfef675fe0bfe4d4f8cab13d3c78ef905f4cea1beb49c8e1
-
SHA512
cabc32d261ffb5769fc3eca73a076ee0bfdba8da509cd99ca60f287f8ba5662c1ff5a248d2dc57478e7a13dd5fe994f948e741c45ebd292d2199922178489b91
-
SSDEEP
768:rf4oTBvDOevZCwrvtjizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2Vy0:D4olvDetT5fTR4Lh1NisFYBc3cr+UqV3
Malware Config
Extracted
https://patriciamirapsicologa.com/wp-includes/UfQQtX1LEVwNJPCx/
https://gavalisamajsevasangh.com/abcd-trey/q4hH2T12X/
https://yatrataxi.com/folwu/LC5yH9Ai0l/
https://thelastpeopleonearth-dayz.com/wp-content/V2mmGey/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8fc638fb4ed752cddfef675fe0bfe4d4f8cab13d3c78ef905f4cea1beb49c8e1.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d0b35300e81378f2cbae9e4621a8386a
SHA18704504423356eeb91c4dd7552027e11c43d72cc
SHA25629ecb32e1a5fecd6b0dd8e06b7caae3cb349ae9a3471df09746d43cd0dc4de5b
SHA5125fadb319c42757d2257bcb83e269f410d694e2e45c36cbe8618149f605a87dd71d3c340023097139a6a02012d4f16efb95c78a02fa4a0226e65b5f5308daaa63
-
Filesize
169KB
MD50d4da0e74d90052690c8f15badf26575
SHA166340bdaf3c0b58696f0257ad7a6e2586b1b5de5
SHA2562ea5f80d153495057d614df2dd8acae7eb1565d6ae59a48e44ca4d96331a9451
SHA5121690369827e9135d32ddf7f032d1005fec9f8d3e754ed0561f77900c1b46d6e43b779bacff3084eb4d6693a20c1279d5dc8017805eea0a3fed768934dde1781e
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB