Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 11:24
General
-
Target
c70187840157ca3ec274937855c2ff15335cbdfd53d8a51f9914e284050a57e5.xlsm
-
Size
46KB
-
MD5
48c0a3f719aa591e74522a93602d60b8
-
SHA1
e193113ae51ab2de6711f9e11ce95d9081df9286
-
SHA256
c70187840157ca3ec274937855c2ff15335cbdfd53d8a51f9914e284050a57e5
-
SHA512
b5b1dfd4749a176add3db0221cacf79c465001d8d6ec4a981abde48e5e0a9bb48051f200923b479cf400a1feb265f1955e01fb970dc7cd3ad36d6912c1e7e9df
-
SSDEEP
768:L1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:L1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu
Malware Config
Extracted
http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/
http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/
http://www.floresguitarinstruction.com/wp-admin/jWlCX/
http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/
http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c70187840157ca3ec274937855c2ff15335cbdfd53d8a51f9914e284050a57e5.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5959e1300f3e8a5ebe3b7a8d8604d99c9
SHA11c54dbdcf3949fec8c815a29c2539859dd11a2fe
SHA256751ae8463f423e42cb1f16d438188e867d04d5eb18ac64591abad7ab2d1cdd34
SHA51242402923370ab8020a7e59eaa098b81d8ee5026b7037c7b9f53877f9d6d2cc075de62234c21f3b9b2eee04ed4694c2df654369b1e3750a14dfe2328932c6988d
-
Filesize
4KB
MD53fe882d7d6f6e3fe5c138575bb867844
SHA10a72443e1ff46b1bd26fc7c70b0132fb9b0d22a1
SHA25605061cf064e8725900a1ccfb5259baaa82d333b4ad88e200fdf7138c8a21bcca
SHA512a737b6a67ad01df1c0427e83c87588f8d1cbd0e7be8f53eeed4a6b6f36e715d923b54a20490c16db865cfac4841bbe269462bfc81cdf2b10816aecc8cc3f1d3d
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB