Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 22:10
General
-
Target
ee649fe7939592811d5eea52d13f4776f82d33634c1fa37657e3acde44676f29.xls
-
Size
243KB
-
MD5
f3b2c6bc5ad19119261b2bbe7e12a00b
-
SHA1
d1a34cc4d4a9e214d1ef41a4016bf8b35df59dd4
-
SHA256
ee649fe7939592811d5eea52d13f4776f82d33634c1fa37657e3acde44676f29
-
SHA512
60c606da2cf9c91a788072ae419d658362880da4f43e338ed0ea420f229b99f4b787f5b49aa650f9dbc468cc0e9b1eaaab34a69dd9c5a51b28d00fcc6767fb82
-
SSDEEP
6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/0Y:ghEXs5fXR8rsNT
Malware Config
Extracted
http://servidorcarlosydavid.es/wp-admin/jkNPgHxNjF/
https://gmo-sol-p10.heteml.jp/includes/UoJMgYAc1EES/
https://iashanghai.cn/z/Z1PG6ulBh20plss/
https://www.pasionportufuturo.pe/wp-content/HkUfvw0xuCy5/
http://dmdagents.com.au/vqwbgz/CL4Bo4C4VS0deg/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ee649fe7939592811d5eea52d13f4776f82d33634c1fa37657e3acde44676f29.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD532a5b42c01c66cb897f667ca97ae27a1
SHA1d05611e7a0d838f56d9249ffb0089647292bff07
SHA2564386bcdce3bb8c2110f9968de5656176e92c96e94f0843f2a65b92876b9012b7
SHA512f7d663d9390edb3467e341c575417b47dc4ee05182f82e8771183556dfdaddf622421ac1b19e6a5379049180d09b2793d2a23816e65286228c3f5a472b5e7b0f
-
Filesize
45KB
MD50cfe08d0b76f6c16d79dffcb527d94bb
SHA160d63b9a567e6d1df9b0527ae21b1cd4c767bd8b
SHA256f3a99f22b32ae07964ad6e46f8ccd537f654da7eaa70ebe162efc85cfc1a332d
SHA51203852181f0944ba7a8fd67b9aa8ef1cb1d947be6f5b774eac2d8a5efaa689a1229918eaa9ae9d9384dfaa40b85c1a1a5d3ee036aec5e41f11012b16d33bb48cb
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB