Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 22:56
Behavioral task
behavioral1
Sample
0b070bad0bd2b0f4d7846c6cda84171d341f586a12edd8f58eed6a55d5e4dc06.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
0b070bad0bd2b0f4d7846c6cda84171d341f586a12edd8f58eed6a55d5e4dc06.xls
Resource
win10v2004-20241007-en
General
-
Target
0b070bad0bd2b0f4d7846c6cda84171d341f586a12edd8f58eed6a55d5e4dc06.xls
-
Size
56KB
-
MD5
8c34ead262ea23890ca5f6f7f9840242
-
SHA1
d3b89255707f80d790773a0e548091df7baa338d
-
SHA256
0b070bad0bd2b0f4d7846c6cda84171d341f586a12edd8f58eed6a55d5e4dc06
-
SHA512
f6bb34dabcc1dfab1578281f6005d9c1374c423d9ba3c434225eb74e6a3c059ab0b4a482a24fa0b35caf61873e81efe8b1345afc7943c45321e9ced12990d7b6
-
SSDEEP
1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvj:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgo
Malware Config
Extracted
http://church.ktc-center.net/PbSkdCOW/
https://chobemaster.com/components/gus/
https://christianchapman.com/cgi-bin/gADHL9UXSFUTN/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2556 4440 regsvr32.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid Process 4440 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid Process 4440 EXCEL.EXE 4440 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid Process 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE 4440 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
EXCEL.EXEdescription pid Process procid_target PID 4440 wrote to memory of 2556 4440 EXCEL.EXE 92 PID 4440 wrote to memory of 2556 4440 EXCEL.EXE 92 PID 4440 wrote to memory of 2556 4440 EXCEL.EXE 92
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0b070bad0bd2b0f4d7846c6cda84171d341f586a12edd8f58eed6a55d5e4dc06.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\adw.dll2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5545a0c6753abfae9c886674557d60d87
SHA10a5ff8f8ef34b518b7f4525d2641ce7c94efdc27
SHA256f1f9f73648dea13003477edfe3535de3e9e38f19f330c8ec3c3785e15674061f
SHA51252eb2cdb689fbcc343cfb6d109ea2d68c96a8f6a0e0f4000438abdebf2c89512d9e746ad5bfcda24742c0ad83ba587702fea364bf4c2be6184df358acf2735c8
-
Filesize
82B
MD598f4a2fc2ed62a2d58dfd8665525bdf6
SHA16263986a53868c51cea22db308470af551bb2075
SHA2563c1a63b59c237d3bb143e42eb9d309be15312ff604c51bc8ab1fdd1c4b3e08fe
SHA5121ac507d20459ea5a4fb58c6be36fcc0dfc7c1e117a99bae97c52b5498dfbc7bfdb8cf20840fd202db59dbb711e815c3f3f90efb43fec296f0260ee89bce35455