Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 21:31

General

  • Target

    7389895af3e4b050b96bcde9923efb769ce74db466cf2f8585ee98e9c94afeb6.xls

  • Size

    243KB

  • MD5

    82bfc5e5228e6db96cc9ffcc7fa98e3a

  • SHA1

    9f64c99166f453c6c4c04685a5a8692b23e299c2

  • SHA256

    7389895af3e4b050b96bcde9923efb769ce74db466cf2f8585ee98e9c94afeb6

  • SHA512

    c8bce3d2b3dc469128938df367813fcc9e31206752ebf8a84580aa08cef6903cb1031549841198b8bb062e8087b9c862ceb305c8c8c64d9306928fdb263c7ced

  • SSDEEP

    6144:DKpbdrHYrMue8q7QPX+5xtFEdi8/dg/ThvsiKIjvl5fd1Xh8rsoX/w/0s:ghEXs5fXR8rsN/

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://servidorcarlosydavid.es/wp-admin/jkNPgHxNjF/

xlm40.dropper

https://gmo-sol-p10.heteml.jp/includes/UoJMgYAc1EES/

xlm40.dropper

https://iashanghai.cn/z/Z1PG6ulBh20plss/

xlm40.dropper

https://www.pasionportufuturo.pe/wp-content/HkUfvw0xuCy5/

xlm40.dropper

http://dmdagents.com.au/vqwbgz/CL4Bo4C4VS0deg/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\7389895af3e4b050b96bcde9923efb769ce74db466cf2f8585ee98e9c94afeb6.xls
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\xxw1.ocx

    Filesize

    45KB

    MD5

    0cfe08d0b76f6c16d79dffcb527d94bb

    SHA1

    60d63b9a567e6d1df9b0527ae21b1cd4c767bd8b

    SHA256

    f3a99f22b32ae07964ad6e46f8ccd537f654da7eaa70ebe162efc85cfc1a332d

    SHA512

    03852181f0944ba7a8fd67b9aa8ef1cb1d947be6f5b774eac2d8a5efaa689a1229918eaa9ae9d9384dfaa40b85c1a1a5d3ee036aec5e41f11012b16d33bb48cb

  • memory/1764-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1764-1-0x0000000072A4D000-0x0000000072A58000-memory.dmp

    Filesize

    44KB

  • memory/1764-2-0x0000000072A4D000-0x0000000072A58000-memory.dmp

    Filesize

    44KB