Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 22:02
General
-
Target
313ddff51a9a0d69836786e0cc6a315b263d8f531e74608d3bafee90e48036c3.xlsm
-
Size
102KB
-
MD5
9515dfe8bc24d9493147c9292021ecb9
-
SHA1
b2d01da62c4247d851b9ffe82ae6894ef2e6834b
-
SHA256
313ddff51a9a0d69836786e0cc6a315b263d8f531e74608d3bafee90e48036c3
-
SHA512
1249deeffff06ed038bd5fdd0b83a35488318ee4819b726ef9b4c2baf19ec175be6a70577097e210f14a4289c9a7afc3b4629150025ac3c5ea9ee244a65d882e
-
SSDEEP
3072:bhR9cVA3Mqu8hahYIfiQOVOveshVf4KwJQikmGo6:bhRG+MrbtO8eOaDPk1o6
Malware Config
Extracted
http://www.numberscare.com/apocholic/0zs1GFW8z/
https://kratomcoupons.com/wp-snapshots/rRAWKjQIH4Jlc/
http://www.campingforacuresl.com/newdir/yKGYdIxMOqdNzaxeA7G/
https://coffee.devtechnosys.info/app/8UP4CHdtji/
https://dautuchungkhoanquocte.com/wp-admin/X0vaYKzvcqLdmO/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\313ddff51a9a0d69836786e0cc6a315b263d8f531e74608d3bafee90e48036c3.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD564269426287876516d4a93703bb5d059
SHA1b8a43459b034b1daa92d87defc544463e1942710
SHA25616270d163bbf1af25e51493cc223c525fc49b6b46f9f1d7fa0435212223fdf76
SHA512287b7da7db49798ae647fee50910b7ed694711bc89c009cfb85443e27bcf0f3933cebbdb94ef4dd8f683779aafbb43212dc01029ff91fe6137f439248719aa85
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB