5ca569e7566bbc94deeaf0f8c6aac87f5e7d12f508b31f5b67a320c502132daf

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ca569e7566bbc94deeaf0f8c6aac87f5e7d12f508b31f5b67a320c502132daf.xlsm
Size

38KB
MD5

e04ffc173ce256475f3b7bc5b8c8b33c
SHA1

e71f8f1046456966ada265b5dfd61baf1ee2f9fa
SHA256

5ca569e7566bbc94deeaf0f8c6aac87f5e7d12f508b31f5b67a320c502132daf
SHA512

33f7c04f2f95e90e814dbadc67f5b17b66c7d66cf3eb04b9d8ef633c8ae74c776dfeec4cc95a1b81058d8c7fc59d555df71d1ae7d6a17dd83bd70bebc04d685f
SSDEEP

768:6mcXd/GCR8tijOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFs:6mqTeSOZZ1ZYpoQ/pMAeVIyTCR

Score

10^/10

discovery

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.berekethaber.com/dosyalar/4MZnNVw8Z/

xlm40.dropper

https://damjangro.org/data/IlBcH2mM/

xlm40.dropper

https://actwell.fr/logs/cGx7Ll6CB2k0NLWDTcL/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2796	2580	regsvr32.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2580	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2580	EXCEL.EXE
2580	EXCEL.EXE
2580	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2796	2580	EXCEL.EXE	32
PID 2580 wrote to memory of 2796	2580	EXCEL.EXE	32
PID 2580 wrote to memory of 2796	2580	EXCEL.EXE	32
PID 2580 wrote to memory of 2796	2580	EXCEL.EXE	32
PID 2580 wrote to memory of 2796	2580	EXCEL.EXE	32
PID 2580 wrote to memory of 2796	2580	EXCEL.EXE	32
PID 2580 wrote to memory of 2796	2580	EXCEL.EXE	32

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\5ca569e7566bbc94deeaf0f8c6aac87f5e7d12f508b31f5b67a320c502132daf.xlsm
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWow64\regsvr32.exe
  C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\wnru.ocx

Filesize
46KB

MD5
a34943f06300af6f439bba82c0a32bac

SHA1
a5ed813d98ec33e646edeb317a00a5bc3479fd49

SHA256
ed706b8d760bb94c3f3fc8e61b9576d4c96cf0689b88d43a38c851a02277b03a

SHA512
76e65d190382b17aab89861b96d447188777f4acbe9079e19e2f7c9703c84678ebe83540e27d45a92c34caea5081d91c033e25af092d0be351f113d69e4a5ee6

Download Submit
memory/2580-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2580-1-0x0000000072AED000-0x0000000072AF8000-memory.dmp

Filesize
44KB

Download
memory/2580-18-0x0000000072AED000-0x0000000072AF8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads