Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 22:32
General
-
Target
5ca569e7566bbc94deeaf0f8c6aac87f5e7d12f508b31f5b67a320c502132daf.xlsm
-
Size
38KB
-
MD5
e04ffc173ce256475f3b7bc5b8c8b33c
-
SHA1
e71f8f1046456966ada265b5dfd61baf1ee2f9fa
-
SHA256
5ca569e7566bbc94deeaf0f8c6aac87f5e7d12f508b31f5b67a320c502132daf
-
SHA512
33f7c04f2f95e90e814dbadc67f5b17b66c7d66cf3eb04b9d8ef633c8ae74c776dfeec4cc95a1b81058d8c7fc59d555df71d1ae7d6a17dd83bd70bebc04d685f
-
SSDEEP
768:6mcXd/GCR8tijOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFs:6mqTeSOZZ1ZYpoQ/pMAeVIyTCR
Malware Config
Extracted
https://www.berekethaber.com/dosyalar/4MZnNVw8Z/
https://damjangro.org/data/IlBcH2mM/
https://actwell.fr/logs/cGx7Ll6CB2k0NLWDTcL/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5ca569e7566bbc94deeaf0f8c6aac87f5e7d12f508b31f5b67a320c502132daf.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5825e7b3fc39eb07239f238da7990905a
SHA1afe753e95e1cf8e7b3ee28667312b060d0965059
SHA25614642da71629f95a3006b261506dc93597f3656b4811fd56ff06be5861b38214
SHA5124b2cc207b0664beb49623442ca318090b5e3b5c63168ce1231802710362e7d542c42e98e8946b758fba13da80176c40e32c3cdf7e4a9b2cf4196769b55fab4fd
-
Filesize
46KB
MD5a34943f06300af6f439bba82c0a32bac
SHA1a5ed813d98ec33e646edeb317a00a5bc3479fd49
SHA256ed706b8d760bb94c3f3fc8e61b9576d4c96cf0689b88d43a38c851a02277b03a
SHA51276e65d190382b17aab89861b96d447188777f4acbe9079e19e2f7c9703c84678ebe83540e27d45a92c34caea5081d91c033e25af092d0be351f113d69e4a5ee6
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB