Analysis
-
max time kernel
133s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 19:37
General
-
Target
62161d27c8a1506a8c53298548dc35dfba280d838f8b5f41a08bb9d5928f9f27.xls
-
Size
74KB
-
MD5
c236624122d0dbe956e8e89fa7244cbd
-
SHA1
b3e8c1390765de26fbe408f4a42574a2b286f444
-
SHA256
62161d27c8a1506a8c53298548dc35dfba280d838f8b5f41a08bb9d5928f9f27
-
SHA512
ac04e48a1aba76a43d200772b195ae6f86fbb3665d09bf261614af1b3bb9ea1b1f68e06d81e8b86d04991893cf317637d08468244083aa8b2cdfeb2795d97c6e
-
SSDEEP
1536:1jKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEJvhqkCGKL9l7FNc5eQpzW4epUNUDpK:xKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg0
Malware Config
Extracted
https://cliniquepourenfants.com/css/VHvHW6TUoN/
http://clovisclark.com/cristina/oHhyKOoFQilsF2EljI/
http://clearance.jeopardygraphics.com/misc/nqnRup/
http://fmesperanza945.com/fonts/Mta/
http://clanwatson.co.uk/personal/DxlCbK5yxbqq1jqP/
https://classicpaint.net/wp-content/Vx6iP4KOyoZuiwsyW/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\62161d27c8a1506a8c53298548dc35dfba280d838f8b5f41a08bb9d5928f9f27.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57b965a0775da57d8af5ad16ae0250350
SHA1b755f2d6b220eef747f87c2edfddc16542adced4
SHA256370fbcfad46f9c3cb9917e3eec95666ddb2c5f1ebdbebe96c6e3bd7cb0437e1f
SHA512a1046b7b8eb489a8dffbe2096d39a78a75ab605a3d98063df172cc4e711094b67c025cf447afcdff3aa05d21f75c74f2e9efd773e1edca54f3f6e5ad84ca391c
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB