Analysis

  • max time kernel
    133s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 21:47

General

  • Target

    0fa9509fc1fccd23d97a9abe3547b629a55a8fbd6c7c23a4147e391cdbbf6314.xls

  • Size

    47KB

  • MD5

    032ad62d2cf74c0b494772bc32f674a7

  • SHA1

    e4c3a61ac362f6d73d539c153bce00277d2c9471

  • SHA256

    0fa9509fc1fccd23d97a9abe3547b629a55a8fbd6c7c23a4147e391cdbbf6314

  • SHA512

    f1e220815a09edbf26bbeef1f545e9bde9e3b61945662d71e2a86b1ab0f6d7b14987dcfe95aff5956d05655e612feed8d4a7d877ac1fbc364883afe04d791b85

  • SSDEEP

    768:yDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JOiX6DGwUk7qHDSEuRZjiBp5n:y62tfQXi8vgLZkTOHkQT51Vp6AwPe8g1

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://eleselektromekanik.com/69Iq5Pwbd0/s/

xlm40.dropper

https://demo.icn.com.np/stories/Qk/

xlm40.dropper

http://demo34.ckg.hk/service/Atk7RQfUV673M/

xlm40.dropper

https://bitmovil.mx/css/TrgyPiTXy3/

xlm40.dropper

http://dupot.cz/tvhost/DUnMUvwZOhQs/

xlm40.dropper

http://focanainternet.com.br/erros/DepAK3p1Y/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0fa9509fc1fccd23d97a9abe3547b629a55a8fbd6c7c23a4147e391cdbbf6314.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32.exe ..\wnrul.ocx
      2⤵
      • Process spawned unexpected child process
      PID:4720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    cac8af05aad1b326de585270fb82d32e

    SHA1

    18843944c8d0e0e588dc1dbd4b8dfdbb0d95fa93

    SHA256

    2cfc0583a6c5d04ec54ded72d05d0ad21ba3225842f0c8933d3ef8ba85564491

    SHA512

    5d24998bfb002134c652a374e3437a2dcb4812fd75ceb89f3bf1a02e8223b2cc81fe436bd8fe51ba69cd8bedbfd246717b50aef4e4ce16225c658edb3efdab70

  • C:\Users\Admin\wnrul.ocx

    Filesize

    3KB

    MD5

    cc666088a917dd7f5da8b6689069aec0

    SHA1

    f688de634ccd20939a522391abb5049483e726bd

    SHA256

    332d102987273318f13e7fc89a043613c6dd5dd7eb7d21033a2ab73dd438a405

    SHA512

    77a15aebeb10d355e3723fdebd2ea59a09a60d54f09ab9a6f06c52dbfa3bea0965ff49b7a1c2e6f4ff94f3fe903e6301188de2f80801a8a978c8c09b3356c8dc

  • memory/832-17-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-7-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-20-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-8-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-18-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-11-0x00007FFE4DAB0000-0x00007FFE4DAC0000-memory.dmp

    Filesize

    64KB

  • memory/832-6-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-15-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-12-0x00007FFE4DAB0000-0x00007FFE4DAC0000-memory.dmp

    Filesize

    64KB

  • memory/832-16-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-0-0x00007FFE50410000-0x00007FFE50420000-memory.dmp

    Filesize

    64KB

  • memory/832-19-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-10-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-9-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-2-0x00007FFE50410000-0x00007FFE50420000-memory.dmp

    Filesize

    64KB

  • memory/832-14-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-13-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-3-0x00007FFE50410000-0x00007FFE50420000-memory.dmp

    Filesize

    64KB

  • memory/832-1-0x00007FFE9042D000-0x00007FFE9042E000-memory.dmp

    Filesize

    4KB

  • memory/832-30-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-31-0x00007FFE9042D000-0x00007FFE9042E000-memory.dmp

    Filesize

    4KB

  • memory/832-32-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-36-0x00007FFE90390000-0x00007FFE90585000-memory.dmp

    Filesize

    2.0MB

  • memory/832-5-0x00007FFE50410000-0x00007FFE50420000-memory.dmp

    Filesize

    64KB

  • memory/832-4-0x00007FFE50410000-0x00007FFE50420000-memory.dmp

    Filesize

    64KB