Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 18:30
General
-
Target
b583800cd5e6338eef6736009494c549c0c4e74fa230dd79b9b0533ef0ec80a5.xlsm
-
Size
73KB
-
MD5
99e965dd69fa2baf8086de4be2d98e77
-
SHA1
7aee51c72da47a293ce59a85b86f4110fedc8181
-
SHA256
b583800cd5e6338eef6736009494c549c0c4e74fa230dd79b9b0533ef0ec80a5
-
SHA512
4a5a3a17a1613a8d115ba064eb19713a216c0235ced1d5eec785f6bf7803180e1bad192fbcd4791dda74fdacac150fb8bad130e635cb53a374002bbacca14c9e
-
SSDEEP
1536:S41yiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV4XG:x1yiCtzSmICpH7OZuvZGsMX
Malware Config
Extracted
https://appleinfoway.com/venv/5Pp/
http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/
http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/
http://atters.net/cgi-bin/0yIPlpXo3156/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b583800cd5e6338eef6736009494c549c0c4e74fa230dd79b9b0533ef0ec80a5.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD581ac12b815fb053c4d2630cc3cebbc3f
SHA19bc47d04f35c8d91f5d4e22820d6a74378765323
SHA256e07a1a01382023b054efe2e825c700a84c5962303a0a0836882560946a4fddf3
SHA51283f9664b1bcb63c8ae9d68ce275a5a256b844df6b86c6418d65973fef638b9e4305bdcb956e85d3063b8645c721e9ce547133f0194729cb83741351505a0c3a1
-
Filesize
91B
MD513602a959153b8c9b4600e17dc98ebdb
SHA11ac6cd8cd54a7d9a013e7f92be645b275a75243b
SHA2567b5dcf39a3facf8ee0b21a1738d6b652b67768e3321aa848f2d1a5b9f80458c2
SHA512e9bdf50715f9caf53644f3bf4d40e7e31620f00df1e462a9f9c9885f056cdd442cc178c1b5f9f12e5c541199e1e4ca9e06048a9c03413a77276f6ab43b46d923
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB