Analysis
-
max time kernel
133s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 22:09
General
-
Target
dce5b7149bcc9b3e1ae72b8fc913a5fe6e506deb46b58c59274dcd03200c87fe.xlsm
-
Size
45KB
-
MD5
204c22ee0d7030819838e1d2b8d7646b
-
SHA1
e13d19153fd0421e42eec3c61ecd4fd26d233fd0
-
SHA256
dce5b7149bcc9b3e1ae72b8fc913a5fe6e506deb46b58c59274dcd03200c87fe
-
SHA512
82fdf29ee3bd0e9ef469c334663a061a8a5fc816e7a78a6d97336cb93a17f2a7ea465ccc0678a389293752e654422e2a640c0fd5c92fb1a93d9f5c462c2eedb8
-
SSDEEP
768:K+oDxDOevZCwrvt8zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2XCnM:VoDxD8tT5fTR4Lh1NisFYBc3cr+U2USz
Malware Config
Extracted
http://api.zmotpro.com/totalenvironment/logs/8wdgNaq0x/
http://aetoaluminium.com/wp-admin/gkqyKlzXoc/
http://24studypoint.com/wp-admin/3uEUtb/
https://baicc-ct.org/wp-admin/IwhcfC2sdxoToa/
https://mustknew.com/lovecalculator/osDBhPqx0tB1Vtp/
http://kiski023.com/wp-includes/Requests/Cookie/C/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\dce5b7149bcc9b3e1ae72b8fc913a5fe6e506deb46b58c59274dcd03200c87fe.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fbe1cbe2f1fabe940f86228eeb369f78
SHA1d940881f509f1e46f235d26df18351d2f02422e2
SHA256117b01d22156287f4a4183c12398e9a78eb6230ce1246ef531667604d23d14f2
SHA512a31c793322a6c80dfd1c0ac8c7e20c5a747131075ab2c333b06de719a9bea9aebc205936190558ae4c9d4ad75aec920b95f8e23880f2522b6b7fdb92bf8f2ade
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB