Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 21:44
General
-
Target
6e3028072a59205d2ee5f5ead732bb05d831ee42ecf365f888f50b803973cb1b.xlsm
-
Size
20KB
-
MD5
ad5fe5db4ffa5f34af82ca2b5f3c3ce8
-
SHA1
f2bab3b9e4e409b8d235de737cfb929002ab20d6
-
SHA256
6e3028072a59205d2ee5f5ead732bb05d831ee42ecf365f888f50b803973cb1b
-
SHA512
fd3462f6d3024cd2641fef2bfc0abc16c382184295cceb74f709a10318ad9ef4649bf936533aa65a60ee034e5a509a4e0b21a9c056ce917d009efa67fe7cdddb
-
SSDEEP
384:uVb1GNjxKo4CGzPd6ZIwISKb5CzgObff9kC+xbX7ZnR:eINco4FLhnCBn9kC+xbLv
Malware Config
Extracted
https://avirtual.com.ar/portfolio_low/LJtA7G2nnfwBAYE/
http://ard-paya.ir/cgi-bin/ddiue5yX5k28KC33EKw/
http://ascendmedicalsupplies.co.ke/FUTH99YV/faflDNXWq0bPv/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6e3028072a59205d2ee5f5ead732bb05d831ee42ecf365f888f50b803973cb1b.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50c1de4f137583ffe60d117ffd94166d7
SHA1ecf37db8d558a559300e11b476e63823cf291eca
SHA2568680976e759ba6221216526923428988190dae8df2d8c614def5596cc185cb60
SHA5121a9ab5ba9ada17209a9481eaab1c68f05ae2bf39216f34851c6925bea38a565d54130c043e3c696b753643c72d894e37a53d7b2132336bc46e2949435c2297a4
-
Filesize
7KB
MD5adcd72d536a231b6e2d2b54fd8d1ec53
SHA153a649c3044c8477d1d2e16e8a1172efd31effbf
SHA256c7521c3fe257008afb7001f7643f4eff175b0c56dd1c8eeeee8be3f881d5dca8
SHA5122492f491280326ab028d88ba1104909f172eb21e84f4d1c9277b1e1f07f8d6f9fa34c58d8be33e13bf9dc242fbd3e3a401ab9fd407d9fa83c0774cec99e868b7
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB