Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 21:41
General
-
Target
0e336a8f8d10c641e6e6306c919add139f09fb2444aac602a251d8379525a389.xlsm
-
Size
73KB
-
MD5
67e1f72d903db3066e37211a509894c0
-
SHA1
3028263f72e8110afad5c29389946e5d10f5654e
-
SHA256
0e336a8f8d10c641e6e6306c919add139f09fb2444aac602a251d8379525a389
-
SHA512
b982d326bcb282c4100721a92c585408a6d7a6258985767478fab1d50435497fa7d179820ed6ca5f44a528e347706a0537d990a52d30c1acebfa714c798301b4
-
SSDEEP
1536:aLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:d1WiCtzSmICpH7OZuvZGsM0
Malware Config
Extracted
https://www.ankeoman.com/undercons_files/l88ETG/
http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0e336a8f8d10c641e6e6306c919add139f09fb2444aac602a251d8379525a389.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fa8d3022d105d68510557c15302c3d5c
SHA12b4f2774bc6b31d70171c66ad0ced87d4211c5e1
SHA25622a76dabf8e74ab1fc195926c8194302d26147bd9025ec943433b7c3f62b4daa
SHA5129dcb6cd6f58a179ce351835b5a8db8c984442e4c24021f03dbf4e7380d8decc367cdc0f882d4e870e9e71deab6f5354886741b6e2ce58b64b09264d5fb07d76b
-
Filesize
6KB
MD5c16ce81d99df3f8fcc14dee6884354cf
SHA17cbafe67db47973d52415430fcf7da87c0a6e9bf
SHA25646edae29f49b47f8cd66b3ac609ad698a9a832c83710d2c536d0e63efe292770
SHA512d8a7be3fff25e30f2c7362980b8018fdbaf87995918988a5ececd34fb2cd07580ce6c3318d8ac339483888796b721e2948b3937b712d11143221d76cd8cf6fc1
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB