Analysis
-
max time kernel
133s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 17:42
General
-
Target
146232681def5a2f77ed65e8f098ed5cda6e4a4d2982d6f22395b3f8e860ccae.xlsm
-
Size
32KB
-
MD5
9831d54e84b419170c2b3925a977f4d6
-
SHA1
f7121383166b8a11cf17d2a93baac76245078dd6
-
SHA256
146232681def5a2f77ed65e8f098ed5cda6e4a4d2982d6f22395b3f8e860ccae
-
SHA512
b9d3b8f3edd86e93ba1c34c24ce75d6f2a45aa63268b6771a4f630deb1ae7ddcec40f3753f6705a2028bac82a87a69d54ab7e447afea7d08a82a348b1f3cefad
-
SSDEEP
384:sjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:sjpFhNNlizXT28dFfPdkqstJmE6/
Malware Config
Extracted
https://casache.com/web/n3jxwXXwa/
https://www.blessingsource.com/blessingsource.com/rFQ0Ip6lQXXK/
http://ccalaire.com/wp-admin/d1pGRa0X/
http://cdimprintpr.com/brochure2/A9NmYDndZ/
http://careerplan.host20.uk/images/Ls/
http://ausnz.net/2010wc/odSi5tQKkCIXEWl9/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\146232681def5a2f77ed65e8f098ed5cda6e4a4d2982d6f22395b3f8e860ccae.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53ba39ea5eed1181555189b9fb50dda17
SHA13cf419ebc55202dbfb87d278e19aa521ed8d95bb
SHA2566076cb62b40e41c68ed70a812a9d8fee942cd4d9808cb8d640566b17d0f39201
SHA512e4dc0a737957bcc98b545a25ce6fc173c120528dd56c0ebe8064f83510fb3941c05a7bd9b16d4580515705ee39ee46fc45efcf274f4f267d0f75efaf10fa1c9b
-
Filesize
166KB
MD5618ba093767c2f8e633e2c1e4cb05df3
SHA12b34a203ccc0cc4adb0779d1a21675b400b4423a
SHA25644098f0de1aff178ffd21d6815b258a7ae88d0abae68bce4102fa4217fbdd0e2
SHA51294f101f86ccea38f31cab12a2165ba752e1aec4023c85d978b1fca41a0d00d4af0419356659bc719a1248d4f5163927678397463b1297d77a0db8d17af15086a
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB