24b4ab604c01ad537704980ce0e2dc8f97ef4f59e0453918eed6de272dc93ee0

Resubmissions

19/11/2024, 16:46

241119-vabhkaygrk 6

19/11/2024, 16:43

241119-t8gxkatjhj 6

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Relacion_servicios_prestados_por_municipio_air-e_FE-8853.xlsx
Size

104KB
MD5

e0e6ba58d45400c5315fc56f19610e15
SHA1

52459c07ad9e3f89e52851fc38cdf1a20d04aa9f
SHA256

74c5130b20bdc7310c937ae3b77e702cc74d0e7cb3a53f4c93e4bb9a3dd94a12
SHA512

257b218aa886f48e841767adb59c488e97ff164143eac0d50cbcee7fe40d8d272f2e565e7cf6f10a969e96c84b697a167d8dfa606d070a859acaa0adcf569940
SSDEEP

3072:iPHMACucROW+yJk6pPW4fmHo/8s8yfkH8Vhg:ivVCu2TRK6pPW4fmHon8ykZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2916	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2916	EXCEL.EXE
2916	EXCEL.EXE
2916	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Relacion_servicios_prestados_por_municipio_air-e_FE-8853.xlsx
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2916-1-0x000000007298D000-0x0000000072998000-memory.dmp

Filesize
44KB

Download
memory/2916-2-0x000000007298D000-0x0000000072998000-memory.dmp

Filesize
44KB

Download