Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 21:51
General
-
Target
8df1d106d40543c97cbc348a243819b98f57f73fb66032261eca92bccfc7a88a.xls
-
Size
70KB
-
MD5
eb2e40c9af72d47872b02e026d94aaca
-
SHA1
a98033c8bc8bc69d7b584c0ff3cd6c411d655caf
-
SHA256
8df1d106d40543c97cbc348a243819b98f57f73fb66032261eca92bccfc7a88a
-
SHA512
a835c963d61592501b20ef26e7f0e7fa9f4c10c1e5d2e2907d73902b53b854f7568b0f96e60088a4ad0d44a7415276310614d072f0a6569a05a0f83b81e3fa4e
-
SSDEEP
1536:tOKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+1YW/ESKQHS1yXJFa5etyv:AKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMZ
Malware Config
Extracted
http://congtycamvinh.com/plugins/jG3iqpQaTL1TXYMolH/
http://ecube.com.mx/e2oCWBnC/6wp2K4sfQmVIRy6ZvdiH/
http://dulichdichvu.net/libraries/6vhzwoZoNDSMtSC/
http://gnif.org/administrator/G68HwUGlKNJNU2vh5cz/
https://edoraseguros.com.br/cgi-bin/l7ZERv5deNsfzlZUZ/
https://sanoma.allrent.nl/cgi-bin/KXbI5OhLJ/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8df1d106d40543c97cbc348a243819b98f57f73fb66032261eca92bccfc7a88a.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD542b7dfc092f99d8eb6ccf4a5d080cb45
SHA10ed5e8c5751426d17108783dc8c7ddde79163958
SHA25683d3409384aea33184188aa4bb247627e7f98dfc608925dce30cfbfdd8f285c4
SHA512574378012041e2e9101e75e2bf16d2bd08b7a0bbc7dbe895dad39bae3bef67d3d28549451bfc717633569673c5c2bf9ff14b196f34a1ffdb05457a343dc8a2a9
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB